{"id":"CVE-2026-28609","title":"In read of MatroskaExtractor.cpp, there is a possible out-of-bounds write due to improper casting","summary":"In read of MatroskaExtractor.cpp, there is a possible out-of-bounds write due to improper casting. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-704"],"vendor":"google","product":"android","affected":["android = 14.0","android = 15.0","android = 16.0"],"published":"2026-09-08","updated":"2026-09-15","sourceUpdated":"2026-09-15T14:17:03.557","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28609","references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-09-01","label":"security@android.com"}],"tags":["nvd","cve.org","exploit-available"],"epss":0.00277,"epssPercentile":0.20338,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-10T03:57:09.136886Z"},"ingestedAt":"2026-09-08T19:08:49.643Z","exploits":{"github":1,"githubRepos":["https://github.com/devrodT2/CVE-2026-28609-matroska-pcm-oob"],"checkedAt":"2026-09-21T15:28:37.184Z"},"exploitAvailable":true,"slug":"CVE-2026-28609","body":"## Overview\n\nIn read of MatroskaExtractor.cpp, there is a possible out-of-bounds write due to improper casting. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.\n\n## Affected\n\n- `android = 14.0`\n- `android = 15.0`\n- `android = 16.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":60,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":208443,"id":"CVE-2026-28609","ts":1790005479049,"field":"exploit_available","old":"false","new":"true"},{"seq":201521,"id":"CVE-2026-28609","ts":1789399510898,"field":"cvss","old":null,"new":"8.8"},{"seq":201520,"id":"CVE-2026-28609","ts":1789399510898,"field":"severity","old":"none","new":"high"},{"seq":200255,"id":"CVE-2026-28609","ts":1789397086304,"field":"cvss","old":"8.8","new":null},{"seq":200254,"id":"CVE-2026-28609","ts":1789397086304,"field":"severity","old":"high","new":"none"},{"seq":198179,"id":"CVE-2026-28609","ts":1789391740673,"field":"cvss","old":null,"new":"8.8"},{"seq":198178,"id":"CVE-2026-28609","ts":1789391740673,"field":"severity","old":"none","new":"high"},{"seq":195972,"id":"CVE-2026-28609","ts":1789383399393,"field":"cvss","old":"8.8","new":null},{"seq":195971,"id":"CVE-2026-28609","ts":1789383399393,"field":"severity","old":"high","new":"none"},{"seq":194901,"id":"CVE-2026-28609","ts":1789380300419,"field":"cvss","old":null,"new":"8.8"},{"seq":194900,"id":"CVE-2026-28609","ts":1789380300419,"field":"severity","old":"none","new":"high"},{"seq":193688,"id":"CVE-2026-28609","ts":1789378268930,"field":"cvss","old":"8.8","new":null},{"seq":193687,"id":"CVE-2026-28609","ts":1789378268930,"field":"severity","old":"high","new":"none"},{"seq":192475,"id":"CVE-2026-28609","ts":1789376233303,"field":"cvss","old":null,"new":"8.8"},{"seq":192474,"id":"CVE-2026-28609","ts":1789376233303,"field":"severity","old":"none","new":"high"},{"seq":191262,"id":"CVE-2026-28609","ts":1789373126620,"field":"cvss","old":"8.8","new":null},{"seq":191261,"id":"CVE-2026-28609","ts":1789373126620,"field":"severity","old":"high","new":"none"},{"seq":190047,"id":"CVE-2026-28609","ts":1789369121047,"field":"cvss","old":null,"new":"8.8"},{"seq":190046,"id":"CVE-2026-28609","ts":1789369121047,"field":"severity","old":"none","new":"high"},{"seq":188834,"id":"CVE-2026-28609","ts":1789368038364,"field":"cvss","old":"8.8","new":null},{"seq":188833,"id":"CVE-2026-28609","ts":1789368038364,"field":"severity","old":"high","new":"none"},{"seq":187617,"id":"CVE-2026-28609","ts":1789364996528,"field":"cvss","old":null,"new":"8.8"},{"seq":187616,"id":"CVE-2026-28609","ts":1789364996528,"field":"severity","old":"none","new":"high"},{"seq":186404,"id":"CVE-2026-28609","ts":1789363002393,"field":"cvss","old":"8.8","new":null},{"seq":186403,"id":"CVE-2026-28609","ts":1789363002393,"field":"severity","old":"high","new":"none"},{"seq":185190,"id":"CVE-2026-28609","ts":1789360969719,"field":"cvss","old":null,"new":"8.8"},{"seq":185189,"id":"CVE-2026-28609","ts":1789360969719,"field":"severity","old":"none","new":"high"},{"seq":183977,"id":"CVE-2026-28609","ts":1789357943417,"field":"cvss","old":"8.8","new":null},{"seq":183976,"id":"CVE-2026-28609","ts":1789357943417,"field":"severity","old":"high","new":"none"},{"seq":182229,"id":"CVE-2026-28609","ts":1789354097907,"field":"cvss","old":null,"new":"8.8"},{"seq":182228,"id":"CVE-2026-28609","ts":1789354097907,"field":"severity","old":"none","new":"high"},{"seq":181022,"id":"CVE-2026-28609","ts":1789352943385,"field":"cvss","old":"8.8","new":null},{"seq":181021,"id":"CVE-2026-28609","ts":1789352943385,"field":"severity","old":"high","new":"none"},{"seq":179815,"id":"CVE-2026-28609","ts":1789350001092,"field":"cvss","old":null,"new":"8.8"},{"seq":179814,"id":"CVE-2026-28609","ts":1789350001092,"field":"severity","old":"none","new":"high"},{"seq":178608,"id":"CVE-2026-28609","ts":1789347814329,"field":"cvss","old":"8.8","new":null},{"seq":178607,"id":"CVE-2026-28609","ts":1789347814329,"field":"severity","old":"high","new":"none"},{"seq":177401,"id":"CVE-2026-28609","ts":1789346181722,"field":"cvss","old":null,"new":"8.8"},{"seq":177400,"id":"CVE-2026-28609","ts":1789346181722,"field":"severity","old":"none","new":"high"},{"seq":176194,"id":"CVE-2026-28609","ts":1789342752018,"field":"cvss","old":"8.8","new":null},{"seq":176193,"id":"CVE-2026-28609","ts":1789342752018,"field":"severity","old":"high","new":"none"},{"seq":175978,"id":"CVE-2026-28609","ts":1789342358520,"field":"cvss","old":null,"new":"8.8"},{"seq":175977,"id":"CVE-2026-28609","ts":1789342358520,"field":"severity","old":"none","new":"high"},{"seq":175518,"id":"CVE-2026-28609","ts":1789338390020,"field":"cvss","old":"8.8","new":null},{"seq":175517,"id":"CVE-2026-28609","ts":1789338390020,"field":"severity","old":"high","new":"none"},{"seq":174313,"id":"CVE-2026-28609","ts":1789334604772,"field":"cvss","old":null,"new":"8.8"},{"seq":174312,"id":"CVE-2026-28609","ts":1789334604772,"field":"severity","old":"none","new":"high"},{"seq":173108,"id":"CVE-2026-28609","ts":1789333197434,"field":"cvss","old":"8.8","new":null},{"seq":173107,"id":"CVE-2026-28609","ts":1789333197434,"field":"severity","old":"high","new":"none"},{"seq":171922,"id":"CVE-2026-28609","ts":1789330884487,"field":"cvss","old":null,"new":"8.8"}]}