CVE-2026-28609

An out-of-bounds write exists in the Matroska file parser (MatroskaExtractor.cpp) of the Android media framework, caused by improper type casting (CWE-704) when reading Matroska/WebM container data. An attacker who can get a device's media stack to process a maliciously crafted Matroska (MKV) or WebM file can corrupt memory and achieve remote code execution with no additional execution privileges and, per the advisory, no user interaction required. Any Android device whose media framework uses the affected AOSP Matroska extractor is affected; the available data does not specify which Android versions or patch levels are vulnerable. Exploitation has not been observed: there is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and the EPSS model estimates a roughly 0.2% probability of exploitation within 30 days.

What to do: Apply the Android security update that fixes CVE-2026-28609 when your device or OEM delivers it, and check the Android Security Bulletin and your current security patch level, since specific vulnerable/fixed versions are not listed in the available data. Until patched, reduce risk by avoiding opening .mkv/.webm files from untrusted sources in apps that rely on the platform media stack. Given no known PoC, no KEV listing, and low EPSS (~0.2%), there is no evidence of active exploitation, but monitor advisories for updates.