Loading vulnerability…
CVE-2026-0006 is a critical Android System vulnerability affecting Android 16 and associated with the Media Codecs Mainline component. The issue is described as a heap buffer overflow that can cause out-of-bounds read and write in multiple locations. The memory corruption condition can be triggered remotely and may allow arbitrary code execution within the affected context. Publicly available information does not identify the exact vulnerable function or code path beyond its placement in the System component and linkage to Media Codecs.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository is a compact exploit/reproduction kit for CVE-2026-0006, a heap buffer overflow in libopenapv as integrated into Android 16's APV decoder path. It is not part of a larger exploit framework. The repository contains one delivery/generation path and two native proof-of-concept programs that validate the bug at the decoder level. Structure and purpose: - README.md documents the vulnerability, affected versions, setup steps, and expected crash behavior. - generate_overflow_mp4.py is the main exploit-building component. It reads a valid APV bitstream and a baseline MP4, prepends a forged AU_INFO PBU claiming 16x16 dimensions, preserves the original frame data that decodes as 64x64, patches MP4/APV metadata fields (apvC, apv1 sample entry, tkhd) to 16x16, replaces the mdat payload, and updates stsz/stco bookkeeping. The result is apv-mp4/overflow_auinfo.mp4. - deploy_exploit_mp4.sh operationalizes the exploit against a connected Android device/emulator: it generates the MP4, pushes it to /sdcard/Download/overflow_auinfo.mp4, triggers media scanning, opens it via Android VIEW intents (preferably in Google Photos), and inspects logcat for SIGSEGV/ASan-style crash evidence. - poc_mp4_asan.c is an end-to-end native PoC that mimics the Android C2SoftApvDec flow by parsing MP4 mdat content, checking the aPv1 signature, calling oapvd_info() to obtain attacker-controlled small dimensions, allocating buffers accordingly, and then calling oapvd_decode() where the larger real frame dimensions cause an out-of-bounds write. This is intended for ASan-instrumented confirmation. - poc_android_oob_write.c is a lower-level standalone PoC that loads an APV file directly, exercises oapvd_info()/oapvd_decode(), and includes a deliberate undersized-buffer test with guard bytes to measure overflow into adjacent memory. Main exploit capability: The exploit is a malicious media-file generator and deployment helper. Its core primitive is a dimension-confusion bug between metadata parsed by oapvd_info() and actual frame dimensions consumed by oapvd_decode(). This yields a heap out-of-bounds write during APV decoding. The repository demonstrates crash reproduction and the memory corruption condition that could underpin zero-click remote code execution when vulnerable Android media components automatically process the file for thumbnails/previews. Notable targeting details: The code and documentation specifically target Android 16 devices with APV codec support and pre-March 2026 patch levels, as well as upstream libopenapv versions v0.1.11.1 through v0.1.13.0. The Android delivery path relies on local adb interaction rather than remote network communication. No command shell payload or post-exploitation logic is included; the repository focuses on exploit file creation and vulnerability reproduction, making it operational but still primarily a crash/reproduction exploit rather than a full weaponized RCE chain.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
29 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical Android System remote code execution vulnerability that can be exploited without user interaction or additional privileges.
Critical Android System component vulnerability that could allow remote code execution without additional privileges or user interaction.
Critical Android System component vulnerability that could allow remote code execution without additional privileges or user interaction.
A critical remote code execution vulnerability in Android's core System component that could allow remote code execution without additional privileges.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.