CVE-2026-0129: Low severity Google Android vulnerability
In RtcpByePacket::decodeByePacket, there is a possible due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict exposure to untrusted RTCP traffic and drop or block RTCP BYE packets from untrusted sources at network boundaries (firewall, SBC, WAF) or via network ACLs to reduce the ability for remote actors to deliver trigger data to RtcpByePacket::decodeByePacket.
- Operational
Monitor vendor/security advisories for a patch addressing the RtcpByePacket::decodeByePacket bounds-check issue and apply the vendor-provided update as soon as it is available. Until a patch is available, avoid interacting with untrusted RTCP/VoIP media streams and consider isolating systems that process RTCP from untrusted networks.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0129?
CVE-2026-0129 has a severity score of 3.5, classified as low.
What types of vulnerabilities are associated with CVE-2026-0129?
CVE-2026-0129 involves a missing bounds check that can lead to remote information disclosure.
How can CVE-2026-0129 be exploited?
CVE-2026-0129 can be exploited through user interaction, but it requires no additional execution privileges.
What software is affected by CVE-2026-0129?
CVE-2026-0129 affects Google Android systems.
What is the potential impact of CVE-2026-0129?
The potential impact of CVE-2026-0129 is remote information disclosure.