CVE-2026-0161: In numberOfReportBlocks of RtpSession

Synopsis

An integer overflow in the RtpSession.cpp component of the Android kernel enables an out-of-bounds write that a remote attacker can reach over the network. The vulnerability requires only a low-privilege account and no victim interaction, and successful exploitation grants the attacker escalated privileges on the device, along with full read, write, and crash capability over affected resources. No fix version has been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable RtpSession component is reachable over the network, so an attacker must be able to send crafted RTP traffic to the target device.

• AuthenticationRequired

  A low-privilege account is sufficient; no administrative or elevated credentials are needed beyond basic authenticated access.

• Victim interactionNot required

  Exploitation is fully remote and silent; no user action such as clicking a link or opening a file is needed.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no specific race conditions, memory-layout knowledge, or other environmental prerequisites.

Blast Radius

• A successful attacker gains escalated privileges on the compromised Android device, moving beyond their initial low-privilege account.
• With high confidentiality impact, the attacker reads sensitive data stored on the device, including credentials, session tokens, and application data.
• With high integrity impact, the attacker modifies files, databases, or kernel state on the device.
• With high availability impact, the attacker crashes the affected service or the kernel, causing a denial of service on the device.