CVE-2026-0131
Description
An integer overflow in RtpPacket::decodePacket leads to an out-of-bounds access, enabling local escalation of privilege on affected Pixel devices with user interaction.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
An integer overflow in RtpPacket::decodePacket leads to an out-of-bounds access, enabling local escalation of privilege on affected Pixel devices with user interaction.
Vulnerability
In the RtpPacket::decodePacket function of the kernel component on Pixel devices, an integer overflow can lead to an out-of-bounds memory access. This vulnerability affects Pixel devices running a security patch level before 2026-06-05. The specific subcomponent is not disclosed in the available references, but the issue resides in the kernel handling of RTP packets [1]. Severity is High, with type Elevation of Privilege (EoP) [1].
Exploitation
An attacker requires local access and must convince a user to interact with a crafted application or input that triggers the vulnerable code path. No additional execution privileges are needed to initiate the exploit. The user interaction could be, for example, opening a malicious media file or processing a crafted network packet that invokes the decodePacket function [1]. The integer overflow occurs when calculating a buffer size or offset, leading to an out-of-bounds read or write.
Impact
Successful exploitation allows an attacker to escalate their privileges locally on the device. The impact is a compromise of confidentiality, integrity, or availability (CIA) at an elevated privilege level, potentially gaining kernel-level code execution or access to protected data [1].
Mitigation
Google released a fix in the June 2026 Pixel Update Bulletin, with security patch level 2026-06-05. All supported Pixel devices are encouraged to install this update. No workarounds are provided in the referenced bulletin [1].
AI Insight generated on Jun 16, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.
References
1News mentions
0No linked articles in our index yet.