CVE-2026-0131: In RtpPacket::decodePacket, there is a possible out of bounds access due to an integer overflow

Synopsis

An integer overflow in the Android kernel's RtpPacket::decodePacket function allows an attacker with a local shell on the device to perform an out-of-bounds memory access. Exploitation requires a low-privilege account and some form of user interaction, and a successful attack grants full local escalation of privilege, giving the attacker read and write access to sensitive data as well as the ability to disrupt services. No fix version has been published yet; HarborGuard tracks the upstream advisory and will make a patched-image rebuild available as soon as Google ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the device is required to trigger the vulnerability.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no elevated or administrative credentials are needed beyond that.

• Victim interactionRequired

  A user on the device must perform some action (such as opening a malicious file or responding to a crafted request) for exploitation to succeed.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• Reads sensitive files, credentials, and application data accessible to higher-privilege processes on the device.
• Writes or modifies protected system files and persisted application data.
• Crashes or disrupts running services on the affected device.
• Achieves full local privilege escalation, effectively giving the attacker control equivalent to a privileged system process.