{"id":"ASB-A-486464711","details":"In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-486464711","CVE-2026-58868"],"modified":"2026-11-02T16:56:25.035054595Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/7d328ec5b7320f067d38955a3a0e23b7c16d8dfd","target":{"file":"media/libstagefright/FrameDecoder.cpp","function":"MediaImageDecoder::onOutputReceived"},"deprecated":false,"digest":{"length":2761,"function_hash":"14971058762342113222987035164005125676"},"id":"ASB-A-486464711-0d7fc3ce","signature_type":"Function"},{"digest":{"line_hashes":["56148501091498996342373282339934476820","332818756163477779612561436932838179261","62751261081472084587792854915437327889"],"threshold":0.9},"id":"ASB-A-486464711-71872de5","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/7d328ec5b7320f067d38955a3a0e23b7c16d8dfd","target":{"file":"media/libstagefright/FrameDecoder.cpp"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/7d328ec5b7320f067d38955a3a0e23b7c16d8dfd"],"severity":"Critical","spl":"2026-11-01","types":["RCE"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-486464711.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["RCE"],"vanir_signatures":[{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["56148501091498996342373282339934476820","332818756163477779612561436932838179261","62751261081472084587792854915437327889"]},"id":"ASB-A-486464711-2a188166","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/732be4b49e2defb57e3b360e5b014162439a8903","target":{"file":"media/libstagefright/FrameDecoder.cpp"}},{"deprecated":false,"digest":{"function_hash":"282399388958571951614906666657160321856","length":2813},"id":"ASB-A-486464711-d1b977af","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/732be4b49e2defb57e3b360e5b014162439a8903","target":{"function":"MediaImageDecoder::onOutputReceived","file":"media/libstagefright/FrameDecoder.cpp"}}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/732be4b49e2defb57e3b360e5b014162439a8903"],"severity":"Critical","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-486464711.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"Critical","spl":"2026-11-01","types":["RCE"],"vanir_signatures":[{"id":"ASB-A-486464711-92ccfcd3","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/10dec31735cdf6bc8e4923d9b8a862b0e6f10138","target":{"file":"media/libstagefright/FrameDecoder.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["56148501091498996342373282339934476820","332818756163477779612561436932838179261","62751261081472084587792854915437327889"]}},{"deprecated":false,"digest":{"function_hash":"14971058762342113222987035164005125676","length":2761},"id":"ASB-A-486464711-d9c250fd","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/10dec31735cdf6bc8e4923d9b8a862b0e6f10138","target":{"function":"MediaImageDecoder::onOutputReceived","file":"media/libstagefright/FrameDecoder.cpp"}}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/10dec31735cdf6bc8e4923d9b8a862b0e6f10138"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-486464711.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"severity":"Critical","spl":"2026-11-01","types":["RCE"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/4945faf5ae316f27e039d8d9b6cc7b721228c479","target":{"function":"MediaImageDecoder::onOutputReceived","file":"media/libstagefright/FrameDecoder.cpp"},"deprecated":false,"digest":{"length":2761,"function_hash":"14971058762342113222987035164005125676"},"id":"ASB-A-486464711-09a8c4f5"},{"source":"https://android.googlesource.com/platform/frameworks/av/+/4945faf5ae316f27e039d8d9b6cc7b721228c479","target":{"file":"media/libstagefright/FrameDecoder.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["56148501091498996342373282339934476820","332818756163477779612561436932838179261","62751261081472084587792854915437327889"]},"id":"ASB-A-486464711-102000b9","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/4945faf5ae316f27e039d8d9b6cc7b721228c479"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-486464711.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/7d5206d539e9ddf011c25d189d090aa3b3aa9cf7"],"severity":"Critical","spl":"2026-11-01","types":["RCE"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/7d5206d539e9ddf011c25d189d090aa3b3aa9cf7","target":{"file":"media/libstagefright/FrameDecoder.cpp","function":"MediaImageDecoder::onOutputReceived"},"deprecated":false,"digest":{"function_hash":"14971058762342113222987035164005125676","length":2761},"id":"ASB-A-486464711-1598fab7","signature_type":"Function"},{"target":{"file":"media/libstagefright/FrameDecoder.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["56148501091498996342373282339934476820","332818756163477779612561436932838179261","62751261081472084587792854915437327889"]},"id":"ASB-A-486464711-d9c39001","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/7d5206d539e9ddf011c25d189d090aa3b3aa9cf7"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-486464711.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2026-11-01","types":["RCE"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/av/+/a90252279e95af31ea3515e7495f635f03049b75","target":{"file":"media/libstagefright/FrameDecoder.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["56148501091498996342373282339934476820","332818756163477779612561436932838179261","62751261081472084587792854915437327889"]},"id":"ASB-A-486464711-68c60125","signature_type":"Line","signature_version":"v1"},{"id":"ASB-A-486464711-daa30565","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/a90252279e95af31ea3515e7495f635f03049b75","target":{"file":"media/libstagefright/FrameDecoder.cpp","function":"MediaImageDecoder::onOutputReceived"},"deprecated":false,"digest":{"length":2813,"function_hash":"282399388958571951614906666657160321856"}}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/a90252279e95af31ea3515e7495f635f03049b75"],"severity":"Critical"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-486464711.json"}}],"schema_version":"1.9.2"}