CVE-2026-55343

A missing bounds check in the decodeAmr() function of ImsMediaAudioPlayer.cpp, part of Android's IMS (IP Multimedia Subsystem) media stack used for VoLTE/RCS audio, allows an out-of-bounds write when decoding AMR audio. An attacker can trigger the flaw by supplying a crafted AMR audio stream that the victim must interact with, for example by playing a malicious audio message or receiving audio through an IMS-based calling or messaging service. Successful exploitation yields remote code execution with no additional execution privileges needed, with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 8.0). The flaw affects Android devices shipping the vulnerable IMS media component; no specific version range was provided in the source data. No public proof of concept is known, the issue is not in CISA's KEV catalog, and there is no evidence of in-the-wild exploitation at this time.

What to do: Install the latest Android security update as soon as Google and your device OEM publish the fix in a monthly security bulletin, since no fixed version number was specified in the data. Administrators of fleets should prioritize patching devices used for VoLTE/RCS calling. In the interim, users should avoid playing unexpected audio attachments or accepting calls from untrusted sources that could deliver a crafted AMR stream.