CVE-2026-28609

Published: Sep 8, 2026Modified: Sep 15, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

In read of MatroskaExtractor.cpp, there is a possible out-of-bounds write due to improper casting. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected (4)

Products: Google: Android

Google

1 product

Android

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Google Android	Version 14.0
Google Android	Version 15.0
Google Android	Version 16.0
Google Android	Version 16.0 qpr2

Related CWEs

CWE-704

Incorrect Type Conversion or Cast

The product does not correctly convert an object, resource, or structure from one type to a different type.

References (1)

https://source.android.com/docs/security/bulletin/2026/2026-09-01

Source: security@android.com

Vendor Advisory

Timeline

No history available yet.