Executive brief
Android's media processing framework contains a vulnerability in its Matroska container format handler that can cause out-of-bounds memory writes when parsing certain malformed media files. An attacker can exploit this by sending a specially crafted video or audio file to trigger remote code execution without requiring user privileges or interaction—the file is processed automatically by system components. This could allow attackers to gain complete control over an Android device.
Technical details
The vulnerability is a classic out-of-bounds write in MatroskaExtractor.cpp caused by improper type casting during media file parsing. The issue resides in the Android Framework's media system component (System) and is triggered when processing Matroska-format containers. The attack vector is network-based and does not require authentication, user interaction, or elevated privileges—exploitation occurs automatically during normal media parsing. An attacker can achieve remote code execution on the device. The vulnerability affects Android 14 through 16-qpr2 and has been patched in the September 2026 security patch level (2026-09-05 or later).
Affected products
- Google Android 14, 15, 16, 16-qpr2
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched