Loading vulnerability…
CVE-2026-28618 is a critical heap-based out-of-bounds write in the dec_frm_prepare function of the Android System oapv component. Improper handling of data during frame preparation can overflow a heap buffer. The issue affects Android 16, Android 16 QPR2, and Android 17 and can lead to remote code execution without user interaction or additional execution privileges.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This 13-file repository is a redacted Mobile Hacking Lab StreamBox exploit/writeup for CVE-2026-28618, with three executable Python utilities and seven HTML/CSS visualizations of the claimed attack chain, heap layout, APV FRAME layout, session object, player UI, and unlock flow. It contains no APK, bundled clips, live token, ticket key, or flag. The primary exploit generator, encode_overflow.py, creates a raw 64x128 YUV422P10 frame and invokes oapv_app_enc to produce an APV file. StreamBox is described as allocating only a 64x64 10-bit Y plane (0x2000 bytes) but allowing OpenAPV to decode the dimensions stated in the FRAME PBU. With the session directly after that plane, row 64 overwrites session offsets 0x00-0x0f. The generator encodes changed magic values, a configurable token (default 0x03E80143), and handler index 2. Per the supplied documentation, a matching token and handler 2 cause dispatch to win(), resulting in a privileged/tier-2 status. scripts/patch_frame_height.py is explicitly limited to changing the 64x64 frame-height header in every access unit. The repository states that this produces an unvalidated decoder test input lacking valid additional tile data, and it is not a demonstrated exploit path. scripts/unlock.py is a separate curl-based API client. It obtains an instance from the Worker, locally constructs a session buffer containing STREAMBO, the returned token, and handler 2, then submits an HMAC-SHA256 ticket to /api/unlock. Its own docstring clearly notes that it neither runs the decoder nor reads an on-device sessionProof, so a successful API response alone is not evidence that the APV overflow executed. Delivery is described as zero-click in the target lab application: a SEND/VIEW action or streambox:// URL deposits an APV at files/incoming.apv and auto-plays it. The practical exploit depends on the vulnerable memory arrangement and decoder behavior, while remote flag retrieval via the helper also depends on an unavailable secret key from the APK.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Critical remote code execution vulnerability in Android System.
Critical remote code execution vulnerability in the Android System component affecting Android 16, Android 16 QPR2, and Android 17.
A heap-based out-of-bounds write in dec_frm_prepare of oapv.c that could enable remote code execution without additional execution privileges or user interaction.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.