● Android Bulletin · July 2026

Android Security Bulletin: July 2026 Stagefright MediaCodec Triage

Triage of Android's July 2026 security release addressing remote code execution via malformed H.264/H.265 video processing in MediaCodec.

39
CVEs Patched
2
Critical Remote Code Executions
8.8
CVSS MediaCodec
Immediate
Fleet Patch Urgency

सुरक्षा समीक्षा और जोखिम विश्लेषण

Google's July 2026 release resolves CVE-2024-31317 in libstagefright. An integer wrap-around when parsing AVC NAL units allowed remote media files (MMS/WhatsApp) to trigger heap buffer overflows inside the media.codec sandbox.

संवेदनशील कमियों की विस्तृत तालिका

CVE पहचानकर्ता सबसिस्टम / घटक प्रभाव CVSS सक्रिय हमला?
CVE-2024-31317Stagefright / MediaCodecRemote Code Execution8.8 HighYES (Zero-Click Vector)
CVE-2024-31318System ServerPrivilege Escalation7.5 HighNo
CVE-2024-31319NFC Hardware ServiceOut-of-Bounds Read6.3 MediumNo
सोर्स कोड का गहन विश्लेषण

Deep Dive: Android Stagefright MediaCodec OOB Write Teardown →

See the C++ patch from platform/frameworks/av showing safe integer bounds checking during NALU parameter set parsing.

← सम्पूर्ण सुरक्षा निर्देशिका सभी सुरक्षा पैच अपडेट्स →