CVE-2026-0148: In multiple functions of VideoRtpPayloadDecoderNode

Synopsis

An integer overflow leading to an out-of-bounds write exists in the Android kernel's VideoRtpPayloadDecoderNode component. The flaw is reachable over the network by any authenticated (low-privilege) user without requiring any victim interaction, and successful exploitation gives the attacker full remote code execution on the affected device. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable component is reachable over the network, so the attacker must be able to send traffic to the exposed service.

• AuthenticationRequired

  A low-privilege account is sufficient; no administrative or elevated credentials are needed beyond basic authentication.

• Victim interactionNot required

  No action from a user on the target device is required to trigger the vulnerability.

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions or special environmental factors that the attacker must arrange.

Blast Radius

• Attacker achieves remote code execution within the Android kernel context.
• Reads arbitrary memory, including stored credentials, session tokens, and sensitive application data on the device.
• Modifies or corrupts kernel memory, enabling persistent tampering with OS-level state and data.
• Crashes or destabilizes the affected service or entire device, causing a denial of service.