devrodT2/CVE-2026-28609-matroska-pcm-oob

PoC

Proof-of-concept and instrumented reproduction harness for CVE-2026-28609, an out-of-bounds write in Android's MatroskaExtractor reachable via a crafted WebM file with a big-endian PCM audio track.

view exploit source poc_in_githubauthor devrodT2published 2026-09-20catalog poc_in_github

exploited CVEs (1)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2026-28609US	—	0.37% (31st)	Exploit	2026-09-08
In read of MatroskaExtractor.cpp, there is a possible out-of-bounds write due to improper casting. This could lead to remote code execution with no additional execution privileges…

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.

Free scan