● Android Bulletin · July 2026

Android Security Bulletin: July 2026 Stagefright MediaCodec Triage

Triage of Android's July 2026 security release addressing remote code execution via malformed H.264/H.265 video processing in MediaCodec.

39
CVEs Patched
2
Critical Remote Code Executions
8.8
CVSS MediaCodec
Immediate
Fleet Patch Urgency

セキュリティトリアージとリスク評価

Google's July 2026 release resolves CVE-2024-31317 in libstagefright. An integer wrap-around when parsing AVC NAL units allowed remote media files (MMS/WhatsApp) to trigger heap buffer overflows inside the media.codec sandbox.

優先脆弱性トリアージマトリックス

CVE識別番号 対象サブシステム / コンポーネント 影響範囲 CVSS ゼロデイ悪用確認？
CVE-2024-31317Stagefright / MediaCodecRemote Code Execution8.8 HighYES (Zero-Click Vector)
CVE-2024-31318System ServerPrivilege Escalation7.5 HighNo
CVE-2024-31319NFC Hardware ServiceOut-of-Bounds Read6.3 MediumNo
注目ソースコード分析

Deep Dive: Android Stagefright MediaCodec OOB Write Teardown →

See the C++ patch from platform/frameworks/av showing safe integer bounds checking during NALU parameter set parsing.

← セキュリティディレクトリ一覧 すべてのセキュリティ更新情報 →