Android Framework Remote Code Execution Vulnerability via Heap Buffer Overflow

A heap buffer overflow vulnerability has been identified in the Android Framework component, specifically within the sdp_discovery.cc file. This vulnerability allows for remote (proximal/adjacent) code execution without requiring additional execution privileges or user interaction. The issue affects devices running Android versions 14, 15, 16, and 16-qpr2.

Impact

Exploitation of this vulnerability could lead to unauthorized remote code execution on the affected device.

Remediation

Users can update their devices to the June 2026 security patch level to address this vulnerability. For some devices on Android 10 and later, the Google Play system update will also include this patch. Instructions for checking and updating the Android version are available on the Google Play support site.