CVE-2026-0128 Integer overflow in Android
An integer overflow in Android's RTCP feedback packet decoding allows remote attackers to read out-of-bounds memory, potentially disclosing sensitive information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-0128?
CVE-2026-0128 is a medium-severity vulnerability in Google Android, published on 16 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In RtcpFbPacket::decodeRtcpFbPacket, there is a possible out of bounds read due to an integer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
Which versions are affected by CVE-2026-0128?
It affects 1 product.
Products include Google Android.
How do I fix CVE-2026-0128?
Apply the vendor's patch.
Is CVE-2026-0128 being exploited?
There is no known exploitation of CVE-2026-0128 in the wild and no public exploit code.
Other vulnerabilities in Google Android
Sources
Also known as A-481300795, GHSA-6qg7-6c24-p9vf, PUB-A-481300795.