All monthly Android security bulletins from this year have critical CVEs in the media system.
https://source.android.com/security/bulletin/