CVE-2026-0149: In RtpSession::rtpSendRtcpPacket, there is a possible OOB write due to a heap buffer overflow

Synopsis

This is a heap buffer overflow vulnerability in the Android kernel, specifically in the RtpSession::rtpSendRtcpPacket function responsible for handling RTCP network packets. The flaw is reachable over the network by any authenticated user with a low-privilege account, and requires no action from a victim on the target device. Successful exploitation gives an attacker full remote code execution on the affected device. No fix version has been published yet; HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix ships.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable function processes RTCP network packets, so an attacker must be able to reach the service over the network to deliver a malformed packet.

• AuthenticationRequired

  The CVSS vector specifies PR:L, meaning a low-privilege account or session credential is sufficient; no administrative access is required.

• Victim interactionNot required

  The CVSS vector specifies UI:N; the attacker does not need to trick or wait for any user to take an action.

• Attack complexityDetail

  The CVSS vector specifies AC:L, meaning the exploit is reliable and imposes no special environmental conditions or timing requirements on the attacker.

Blast Radius

• Executes arbitrary code in the context of the Android kernel, giving the attacker full control over the compromised device.
• Reads any data accessible to the kernel, including credentials, session tokens, and application data stored on the device.
• Writes or modifies any kernel-accessible memory, allowing tampering with OS state, application data, or persisted storage.
• Crashes or destabilizes the kernel, causing a full device outage or forcing a reboot that disrupts running workloads.