Security researchers from Check Point Technologies have identified critical vulnerabilities in the lossless audio compression coding format used in certain Android devices that if exploited, could allow attackers to elevate privileges, execute arbitrary code remotely, and pilfer sensitive data. Specifically, the flaws affect Android devices using chipsets built by the chip manufacturing giants Qualcomm and MediaTek. These vulnerabilities are located in the open-source Apple Lossless Audio Codec (ALAC), which preserves all the original audio data even after the file has been compressed. Although the details about the flaws won’t be fully released until presentation at the CanSecWest security conference in May 2022, researchers have explained that an attacker can send maliciously crafted audio files to vulnerable users and socially engineer them into opening the file, causing the file to execute. This ability to perform remote code execution (RCE) means that attackers could potentially steal target device data to send back to their command and control (C2) infrastructure, as well as modify hardware configuration settings, and ultimately perform a complete takeover of the device, all with no required user interaction. According to Qualcomm and MediaTek, the vulnerabilities are out-of-bound read/writes and improper audio input validation. RCE flaws in audio codecs are very common, but due to the fact that most are closed-source for security reasons, they are very difficult for even sophisticated hackers to exploit. ALAC presents more of a risk because it is open to the public. These flaws were patched in Android’s December 2021 security update and users are urged to ensure they are at least running that version to defend from these specific exploits. For users running devices that no longer receive automatic updates, it is recommended to install a third-party Android distro that does receive regular updates.