CVE-2026-0144: Medium severity Google Android vulnerability
In writeAocCommand of AocAudioCodec.cpp, there is a possible memory safety issue due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Add explicit bounds/length checks on all inputs and buffer operations in writeAocCommand (AocAudioCodec.cpp) to validate sizes before any memory reads/writes and prevent out-of-bounds access.
AocAudioCodec (writeAocCommand) input_bounds_check = enabled - Compensating control
Until a code fix is available, apply network-level mitigations to reduce exposure: restrict access to the affected audio codec service to trusted IPs, implement rate-limiting or traffic filtering for AOC-related commands, and deploy IDS/WAF rules to detect and block malformed AOC input that could trigger the vulnerability.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0144?
The severity of CVE-2026-0144 is medium with a CVSS score of 6.5.
What type of vulnerability is CVE-2026-0144?
CVE-2026-0144 is a memory safety issue caused by a missing bounds check.
How can CVE-2026-0144 be exploited?
CVE-2026-0144 can be exploited remotely to cause a denial of service without requiring user interaction.
What are the potential impacts of CVE-2026-0144?
The impact of CVE-2026-0144 includes remote denial of service, leading to application unavailability.
Is user interaction required to exploit CVE-2026-0144?
No, user interaction is not required to exploit CVE-2026-0144.