● Android Bulletin · July 2026

Android Security Bulletin: July 2026 Stagefright MediaCodec Triage

Triage of Android's July 2026 security release addressing remote code execution via malformed H.264/H.265 video processing in MediaCodec.

39
CVEs Patched
2
Critical Remote Code Executions
8.8
CVSS MediaCodec
Immediate
Fleet Patch Urgency

Executive Triage & Risk Verdict

Google's July 2026 release resolves CVE-2024-31317 in libstagefright. An integer wrap-around when parsing AVC NAL units allowed remote media files (MMS/WhatsApp) to trigger heap buffer overflows inside the media.codec sandbox.

Curated Vulnerability Triage Matrix

CVE Identifier Subsystem / Component Impact CVSS In-The-Wild Exploitation?
CVE-2024-31317Stagefright / MediaCodecRemote Code Execution8.8 HighYES (Zero-Click Vector)
CVE-2024-31318System ServerPrivilege Escalation7.5 HighNo
CVE-2024-31319NFC Hardware ServiceOut-of-Bounds Read6.3 MediumNo
FEATURED CODE TEARDOWN

Deep Dive: Android Stagefright MediaCodec OOB Write Teardown →

See the C++ patch from platform/frameworks/av showing safe integer bounds checking during NALU parameter set parsing.

← Browse Full Security Directory All Platform Security Updates →