CVE-2026-0160: In TextRtpPayloadDecoderNode::DecodeT140 of TextRtpPayloadDecoderNode

Synopsis

An out-of-bounds write vulnerability exists in the Android kernel's TextRtpPayloadDecoderNode::DecodeT140 function, which handles T.140 real-time text over RTP. The flaw is reachable over the network by any authenticated (low-privilege) user without requiring victim interaction, making it exploitable by any account holder on an affected device or service. Successful exploitation gives an attacker full remote code execution on the affected system. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable code path is reachable over the network, meaning an attacker must be able to send crafted RTP packets to an exposed service.

• AuthenticationRequired

  A low-privilege account is sufficient; no administrative or elevated credentials are needed to reach the vulnerable code path.

• Victim interactionNot required

  No user action such as clicking a link or opening a file is needed; the attacker can trigger the flaw without any involvement from a logged-in user.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• Attacker achieves remote code execution in the context of the affected Android kernel component, with the ability to run arbitrary instructions on the host.
• Confidential data stored on the device or accessible to the kernel, including credentials, session state, and application data, is readable by the attacker.
• The attacker can modify persisted data, kernel structures, or application state, enabling tampering with device behavior or stored records.
• The attacker can crash or destabilize the kernel component, causing service disruption or device unavailability.