● Android Bulletin · July 2026

Android Security Bulletin: July 2026 Stagefright MediaCodec Triage

Triage of Android's July 2026 security release addressing remote code execution via malformed H.264/H.265 video processing in MediaCodec.

39
CVEs Patched
2
Critical Remote Code Executions
8.8
CVSS MediaCodec
Immediate
Fleet Patch Urgency

漏洞风险分类与修复裁决

Google's July 2026 release resolves CVE-2024-31317 in libstagefright. An integer wrap-around when parsing AVC NAL units allowed remote media files (MMS/WhatsApp) to trigger heap buffer overflows inside the media.codec sandbox.

重点漏洞分类评级矩阵

CVE 编号 核心子系统 / 组件 影响程度 CVSS 是否在野利用？
CVE-2024-31317Stagefright / MediaCodecRemote Code Execution8.8 HighYES (Zero-Click Vector)
CVE-2024-31318System ServerPrivilege Escalation7.5 HighNo
CVE-2024-31319NFC Hardware ServiceOut-of-Bounds Read6.3 MediumNo
深度源码剖析

Deep Dive: Android Stagefright MediaCodec OOB Write Teardown →

See the C++ patch from platform/frameworks/av showing safe integer bounds checking during NALU parameter set parsing.

← 浏览完整安全目录 所有平台安全更新 →