CVE-2026-0162: In ParsePayloads of AudioSdpParser

Synopsis

This is a type confusion vulnerability in the Android kernel's audio SDP (Session Description Protocol) parser, specifically in the ParsePayloads function of AudioSdpParser.cpp. The flaw is reachable over the network by any low-privilege authenticated user, with no victim interaction required. Successful exploitation causes memory corruption that gives an attacker full remote code execution on the affected device. No fix version has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable parser is exposed over the network, meaning an attacker must be able to send crafted SDP payloads to the target device across the internet or an accessible network path.

• AuthenticationRequired

  The attacker must hold a low-privilege account; no administrative or elevated credentials are needed beyond that baseline.

• Victim interactionNot required

  No user action such as clicking a link or opening a file is needed; the attacker can trigger the vulnerability entirely without victim participation.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special environmental conditions, race timing, or memory-layout knowledge to succeed.

Blast Radius

• A successful attacker achieves remote code execution on the affected Android kernel, gaining the ability to run arbitrary code in the kernel context.
• Confidentiality impact is high: the attacker can read any data accessible to the kernel, including credentials, session tokens, and application data stored on the device.
• Integrity impact is high: the attacker can modify kernel memory, persisted files, and application data without restriction.
• Availability impact is high: the attacker can crash or hang the kernel, taking the affected device entirely offline.