Researchers detail a patched RCE flaw in the Apple Lossless Audio Codec on Android devices with Qualcomm and MediaTek chips; Apple open sourced ALAC in 2011
Flaw could be exploited with malicious audio file. — Security researchers said they uncovered a vulnerability that could have allowed hackers … Source: Check Point Software .
Context & Ripple Effects
The Qualcomm silicon inside Android phones has been a recurring attack vector for years — from the publicly available exploits that pulled disk encryption keys off Qualcomm devices in 2016 to the critical 2019 flaw spanning 46 of its chipsets and the Snapdragon DSP bugs that let attackers take over a phone with no user interaction. Check Point's new finding extends that pattern beyond the chip vendor's own code.
What makes this one different is the provenance of the vulnerable code: ALAC is Apple's lossless audio codec, open sourced in 2011, and it now ships in Android media stacks on Qualcomm and MediaTek devices. The flaw — remote code execution via a malicious audio file — was patched before researchers detailed it, but it puts Apple in the unfamiliar position of having its decade-old open-source code attacked on a rival platform it doesn't patch directly.
First-order effects
- Android users on Qualcomm and MediaTek devices needed the codec fix pushed through their device update chains, with Check Point holding details until the patch landed.
- Apple's open-sourced ALAC code is now an active attack surface on platforms Apple doesn't control, exploitable by nothing more than a crafted audio file.
Second-order effects
- Qualcomm and MediaTek bear the integration burden: their chipsets' media pipelines carry third-party code whose vulnerabilities they must triage and ship fixes for, adding to a patch pipeline already strained by repeated chip-level flaws.
- OEMs and carriers sit between the disclosure and the user, and slow codec-level patch rollouts would leave the same long tail of unpatched devices seen in earlier Qualcomm incidents.
Third-order effects
- If the pattern holds, open-sourced legacy codecs become a structural blind spot: the original maintainer (Apple) has moved on, deployers (chip vendors, OEMs) inherit the code without the incentive or expertise to audit it deeply, and media parsing joins the DSP as a standing target class on Android.
The trend: Shared, open-sourced media codecs are turning into cross-ecosystem attack surface where the code's author, the chip vendor, and the device maker each assume someone else is auditing it.