CVE-2026-72506 identifies a vulnerability in the VoiceTra (Voice Translator) Android application version 9.1.3, developed by the National Institute of Information and Communications Technology (NICT). The issue involves an incorrectly specified destination in a communication channel, which may cause the app to connect to a malicious server controlled by an attacker. This can result in the compromise of user input data confidentiality and integrity, as well as the potential for displaying incorrect translation outputs. The vulnerability is rated medium severity with a CVSS 3.0 score of 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N). There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

The vulnerability allows an attacker to redirect communication from the VoiceTra app to a malicious server, potentially leading to theft of user input data and manipulation of translation results. The impact is limited to confidentiality and integrity of data with no reported availability impact. The medium severity reflects the network attack vector with low attack complexity and no privileges required, but user interaction is necessary.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when using the affected version 9.1.3 of VoiceTra and avoid using the app on untrusted networks or with sensitive data. Monitor official channels from the National Institute of Information and Communications Technology for updates and apply any provided patches promptly.