{"id":"ASB-A-276442130","details":"In onQueueFilled of SoftMPEG4.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-276442130","CVE-2024-0051"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2024-03-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2024-03-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/av/+/a52c14a5b49f26efafa581dea653b4179d66909e"}],"affected":[{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14-next:0"},{"fixed":"14-next:2024-03-01"}]}],"versions":["14-next"],"ecosystem_specific":{"severity":"High","spl":"2024-03-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/av/+/8f4cfda9fc75f1e9ba3b6dee3fbffda4b6111d64","target":{"file":"media/libstagefright/codecs/m4v_h263/dec/SoftMPEG4.cpp","function":"SoftMPEG4::onQueueFilled"},"deprecated":false,"digest":{"function_hash":"58258811914185388357591294525145251696","length":4937},"id":"ASB-A-276442130-c77ffc32","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["101207474757240796435343960200146357600","159690384445545365884455270351330069343","69342874539732809273301422794809271845","208305776482149095495766562709306394681","255568286799912991290049226333131065560"],"threshold":0.9},"id":"ASB-A-276442130-d38de6bf","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/8f4cfda9fc75f1e9ba3b6dee3fbffda4b6111d64","target":{"file":"media/libstagefright/codecs/m4v_h263/dec/SoftMPEG4.cpp"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/8f4cfda9fc75f1e9ba3b6dee3fbffda4b6111d64"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-276442130.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2024-03-01"}]}],"versions":["12"],"ecosystem_specific":{"spl":"2024-03-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/208e430bc6380fafafca8041b239f835263a9d47","target":{"file":"media/libstagefright/codecs/m4v_h263/dec/SoftMPEG4.cpp"},"deprecated":false,"digest":{"line_hashes":["101207474757240796435343960200146357600","159690384445545365884455270351330069343","69342874539732809273301422794809271845","208305776482149095495766562709306394681","255568286799912991290049226333131065560"],"threshold":0.9},"id":"ASB-A-276442130-6e3bfd91","signature_type":"Line"},{"source":"https://android.googlesource.com/platform/frameworks/av/+/208e430bc6380fafafca8041b239f835263a9d47","target":{"function":"SoftMPEG4::onQueueFilled","file":"media/libstagefright/codecs/m4v_h263/dec/SoftMPEG4.cpp"},"deprecated":false,"digest":{"function_hash":"215691793688832406410561416947397441303","length":4884},"id":"ASB-A-276442130-f20260c4","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/208e430bc6380fafafca8041b239f835263a9d47"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-276442130.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2024-03-01"}]}],"versions":["12L"],"ecosystem_specific":{"severity":"High","spl":"2024-03-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/208e430bc6380fafafca8041b239f835263a9d47","target":{"file":"media/libstagefright/codecs/m4v_h263/dec/SoftMPEG4.cpp"},"deprecated":false,"digest":{"line_hashes":["101207474757240796435343960200146357600","159690384445545365884455270351330069343","69342874539732809273301422794809271845","208305776482149095495766562709306394681","255568286799912991290049226333131065560"],"threshold":0.9},"id":"ASB-A-276442130-c4c3f4ef","signature_type":"Line"},{"id":"ASB-A-276442130-da55123e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/208e430bc6380fafafca8041b239f835263a9d47","target":{"file":"media/libstagefright/codecs/m4v_h263/dec/SoftMPEG4.cpp","function":"SoftMPEG4::onQueueFilled"},"deprecated":false,"digest":{"function_hash":"215691793688832406410561416947397441303","length":4884}}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/208e430bc6380fafafca8041b239f835263a9d47"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-276442130.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2024-03-01"}]}],"versions":["13"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/208e430bc6380fafafca8041b239f835263a9d47"],"severity":"High","spl":"2024-03-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/208e430bc6380fafafca8041b239f835263a9d47","target":{"file":"media/libstagefright/codecs/m4v_h263/dec/SoftMPEG4.cpp"},"deprecated":false,"digest":{"line_hashes":["101207474757240796435343960200146357600","159690384445545365884455270351330069343","69342874539732809273301422794809271845","208305776482149095495766562709306394681","255568286799912991290049226333131065560"],"threshold":0.9},"id":"ASB-A-276442130-81b8bbc4","signature_type":"Line"},{"deprecated":false,"digest":{"length":4884,"function_hash":"215691793688832406410561416947397441303"},"id":"ASB-A-276442130-c4e4aa71","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/208e430bc6380fafafca8041b239f835263a9d47","target":{"function":"SoftMPEG4::onQueueFilled","file":"media/libstagefright/codecs/m4v_h263/dec/SoftMPEG4.cpp"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-276442130.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2024-03-01"}]}],"versions":["14"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"target":{"file":"media/libstagefright/codecs/m4v_h263/dec/SoftMPEG4.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["101207474757240796435343960200146357600","159690384445545365884455270351330069343","69342874539732809273301422794809271845","208305776482149095495766562709306394681","255568286799912991290049226333131065560"]},"id":"ASB-A-276442130-ce5c49a4","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/208e430bc6380fafafca8041b239f835263a9d47"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/208e430bc6380fafafca8041b239f835263a9d47","target":{"file":"media/libstagefright/codecs/m4v_h263/dec/SoftMPEG4.cpp","function":"SoftMPEG4::onQueueFilled"},"deprecated":false,"digest":{"function_hash":"215691793688832406410561416947397441303","length":4884},"id":"ASB-A-276442130-e8cebca2"}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/208e430bc6380fafafca8041b239f835263a9d47"],"severity":"High","spl":"2024-03-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-276442130.json"}}],"schema_version":"1.9.0"}