CVE-2026-0146
published 2026-06-16CVE-2026-0146: In mfc_core_get_dec_metadata_sei_nal of mfc_core_reg_api.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote…
PriorityP337
EPSS
0.28%
19.9th percentile
In mfc_core_get_dec_metadata_sei_nal of mfc_core_reg_api.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| android | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Google Android mfc_core_reg_api.c mfc_core_get_dec_metadata_sei_nal out-of-bounds write
vuldb·2026-06-16
CVE-2026-0146 Google Android mfc_core_reg_api.c mfc_core_get_dec_metadata_sei_nal out-of-bounds write
A vulnerability, which was classified as critical, was found in Google Android. This issue affects the function mfc_core_get_dec_metadata_sei_nal of the file mfc_core_reg_api.c. Such manipulation leads to out-of-bounds write.
This vulnerability is listed as CVE-2026-0146. The attack may be performed from remote. There is no available exploit.
GHSA
In mfc_core_get_dec_metadata_sei_nal of mfc_core_reg_api.c, there is a possible out of bounds write due to a missing bounds check.
ghsa_unreviewed·2026-06-16
CVE-2026-0146 [HIGH] CWE-120 In mfc_core_get_dec_metadata_sei_nal of mfc_core_reg_api.c, there is a possible out of bounds write due to a missing bounds check.
In mfc_core_get_dec_metadata_sei_nal of mfc_core_reg_api.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-16
Published