Heap Buffer Overflow Vulnerability in Android OS
CVE-2026-28618
8.8HIGH
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-28618?
A vulnerability in the Android OS identified as a heap buffer overflow can allow potential attackers to execute remote code without requiring any user interaction. This weakness resides in the 'dec_frm_prepare' function of the 'oapv.c' file, which can be exploited to conduct out-of-bounds writes, making it a notable security concern for users of impacted Android devices. The absence of user interaction for exploitation raises the risk level, emphasizing the need for immediate patching and user awareness.
Affected Version(s)
Android 17
Android 16-qpr2
Android 16
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.