Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NSummary
CVE-2026-0141 is a medium-severity Classic Buffer Overflow (CWE-120) vulnerability in Google Android. Its CVSS base score is 4.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 10th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SC-7 (Boundary Protection) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-37175
Vulnerability Data
In decodeAppPacket of RtcpAppPacket.cpp, there is a possible OOB read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote OOB read in network packet decoder (RTCP) directly enables unauthenticated remote exploitation of a public-facing application for information disclosure.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces validation of packet fields and lengths in decodeAppPacket, eliminating the missing bounds check that enables the OOB read.
Boundary protection devices can filter or rate-limit malformed RTCP packets before they reach the vulnerable decoder.
Continuous monitoring of process memory access patterns or anomalous RTCP traffic can identify attempted exploitation of the OOB read.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure development practices directly enforce bounds checking and input validation that prevent classic buffer overflows.
Vulnerability identification processes such as code review or scanning detect classic buffer overflows before exploitation.
Routine patching replaces vulnerable code containing unchecked buffer copies with corrected versions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure coding directly requires bounds-checked memory operations, addressing the root cause of CWE-120.
Security testing in development and acceptance can detect buffer overflows through fuzzing and static analysis, though it does not prevent them at the source.
Logging can record evidence of an out-of-bounds read but does not prevent the weakness itself.
Secure development life cycle mandates processes that can include input validation and bounds checking to prevent buffer overflows.
Application security requirements can specify input-size validation and safe buffer handling to mitigate classic buffer overflows.
Secure system architecture and engineering principles promote defensive coding patterns that reduce the likelihood of unchecked buffer copies.