● Android Bulletin · July 2026

Android Security Bulletin: July 2026 Stagefright MediaCodec Triage

Triage of Android's July 2026 security release addressing remote code execution via malformed H.264/H.265 video processing in MediaCodec.

39
CVEs Patched
2
Critical Remote Code Executions
8.8
CVSS MediaCodec
Immediate
Fleet Patch Urgency

Triage Eksekutif dan Penilaian Risiko

Google's July 2026 release resolves CVE-2024-31317 in libstagefright. An integer wrap-around when parsing AVC NAL units allowed remote media files (MMS/WhatsApp) to trigger heap buffer overflows inside the media.codec sandbox.

Matriks Triage Kerentanan Pilihan

Pengenal CVE Subsistem / Komponen Dampak CVSS Eksploitasi Aktif?
CVE-2024-31317Stagefright / MediaCodecRemote Code Execution8.8 HighYES (Zero-Click Vector)
CVE-2024-31318System ServerPrivilege Escalation7.5 HighNo
CVE-2024-31319NFC Hardware ServiceOut-of-Bounds Read6.3 MediumNo
ANALISIS KODE PILIHAN

Deep Dive: Android Stagefright MediaCodec OOB Write Teardown →

See the C++ patch from platform/frameworks/av showing safe integer bounds checking during NALU parameter set parsing.

← Jelajahi Direktori Keamanan Lengkap Semua Pembaruan Keamanan →