{"id":"ASB-A-501467247","details":"In process of C2SoftApvDec.cpp, there is a possible out-of-bounds read due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-501467247","CVE-2026-58933"],"modified":"2026-11-02T16:56:25.813540454Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/av/+/f96778b1c09dadf119dc89ccdc030aafd2ca1232","target":{"file":"media/codec2/components/apv/C2SoftApvDec.cpp","function":"C2SoftApvDec::outputBuffer"},"deprecated":false,"digest":{"length":9015,"function_hash":"177097525524166619768057861543823577820"},"id":"ASB-A-501467247-3037f137","signature_type":"Function","signature_version":"v1"},{"target":{"file":"media/codec2/components/apv/C2SoftApvDec.cpp","function":"C2SoftApvDec::process"},"deprecated":false,"digest":{"length":4747,"function_hash":"54188562263792233002577015533996679196"},"id":"ASB-A-501467247-5207db16","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/f96778b1c09dadf119dc89ccdc030aafd2ca1232"},{"digest":{"threshold":0.9,"line_hashes":["16265666744820221475281771137361814903","13691461543068655900772832046018554109","127891695354739092437265180096440632726","10264305234725924288253848067995582406","284738947892107953173605978835009329766","137969635652422045824621184586008298855","120617803438681886879521846681967728196","6082164603585023760962098921432761070","6832932605069395949314562082453745579","174665499851122666361230805535301903028","94685592512341428750641702180488254240","221978912978261298338948968263912952081","39026225067156604891824260993186349787","310271938091124703409103544820172948182","90502856049347749289058443668923839716","125409524848312952304955866848188003195"]},"id":"ASB-A-501467247-661a87f5","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/f96778b1c09dadf119dc89ccdc030aafd2ca1232","target":{"file":"media/codec2/components/apv/C2SoftApvDec.cpp"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/f96778b1c09dadf119dc89ccdc030aafd2ca1232"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-501467247.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/5f5a0d25e71c1bfaaec4b0fd8e07ed1f310a6068","target":{"function":"C2SoftApvDec::outputBuffer","file":"media/codec2/components/apv/C2SoftApvDec.cpp"},"deprecated":false,"digest":{"length":8840,"function_hash":"201665678393525683707306615144761322746"},"id":"ASB-A-501467247-073c08ac","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/5f5a0d25e71c1bfaaec4b0fd8e07ed1f310a6068","target":{"file":"media/codec2/components/apv/C2SoftApvDec.cpp"},"deprecated":false,"digest":{"line_hashes":["16265666744820221475281771137361814903","13691461543068655900772832046018554109","127891695354739092437265180096440632726","10264305234725924288253848067995582406","284738947892107953173605978835009329766","137969635652422045824621184586008298855","120617803438681886879521846681967728196","6082164603585023760962098921432761070","6832932605069395949314562082453745579","174665499851122666361230805535301903028","94685592512341428750641702180488254240","221978912978261298338948968263912952081","39026225067156604891824260993186349787","310271938091124703409103544820172948182","90502856049347749289058443668923839716","125409524848312952304955866848188003195"],"threshold":0.9},"id":"ASB-A-501467247-6e7ee7cb"},{"deprecated":false,"digest":{"function_hash":"26286947209059836925671057043401762352","length":4434},"id":"ASB-A-501467247-d0ba3f77","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/5f5a0d25e71c1bfaaec4b0fd8e07ed1f310a6068","target":{"file":"media/codec2/components/apv/C2SoftApvDec.cpp","function":"C2SoftApvDec::process"}}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/5f5a0d25e71c1bfaaec4b0fd8e07ed1f310a6068"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-501467247.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/87074030d87b06a64be14a4a638b08174341d620","target":{"function":"C2SoftApvDec::outputBuffer","file":"media/codec2/components/apv/C2SoftApvDec.cpp"},"deprecated":false,"digest":{"function_hash":"177097525524166619768057861543823577820","length":9015},"id":"ASB-A-501467247-0b0cbe53"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/87074030d87b06a64be14a4a638b08174341d620","target":{"file":"media/codec2/components/apv/C2SoftApvDec.cpp"},"deprecated":false,"digest":{"line_hashes":["16265666744820221475281771137361814903","13691461543068655900772832046018554109","127891695354739092437265180096440632726","10264305234725924288253848067995582406","284738947892107953173605978835009329766","137969635652422045824621184586008298855","120617803438681886879521846681967728196","6082164603585023760962098921432761070","6832932605069395949314562082453745579","174665499851122666361230805535301903028","94685592512341428750641702180488254240","221978912978261298338948968263912952081","39026225067156604891824260993186349787","310271938091124703409103544820172948182","90502856049347749289058443668923839716","125409524848312952304955866848188003195"],"threshold":0.9},"id":"ASB-A-501467247-d2ca4770"},{"deprecated":false,"digest":{"function_hash":"26286947209059836925671057043401762352","length":4434},"id":"ASB-A-501467247-f7f36c91","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/87074030d87b06a64be14a4a638b08174341d620","target":{"function":"C2SoftApvDec::process","file":"media/codec2/components/apv/C2SoftApvDec.cpp"}}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/87074030d87b06a64be14a4a638b08174341d620"],"severity":"High","spl":"2026-11-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-501467247.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/15891c9875f6c8767e924cf374940183ec94c325","target":{"file":"media/codec2/components/apv/C2SoftApvDec.cpp","function":"C2SoftApvDec::process"},"deprecated":false,"digest":{"function_hash":"26286947209059836925671057043401762352","length":4434},"id":"ASB-A-501467247-63d12523"},{"id":"ASB-A-501467247-8d179bc6","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/15891c9875f6c8767e924cf374940183ec94c325","target":{"file":"media/codec2/components/apv/C2SoftApvDec.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["16265666744820221475281771137361814903","13691461543068655900772832046018554109","127891695354739092437265180096440632726","10264305234725924288253848067995582406","284738947892107953173605978835009329766","137969635652422045824621184586008298855","120617803438681886879521846681967728196","6082164603585023760962098921432761070","6832932605069395949314562082453745579","174665499851122666361230805535301903028","94685592512341428750641702180488254240","221978912978261298338948968263912952081","39026225067156604891824260993186349787","310271938091124703409103544820172948182","90502856049347749289058443668923839716","125409524848312952304955866848188003195"]}},{"deprecated":false,"digest":{"function_hash":"177097525524166619768057861543823577820","length":9015},"id":"ASB-A-501467247-e8f67b8e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/15891c9875f6c8767e924cf374940183ec94c325","target":{"function":"C2SoftApvDec::outputBuffer","file":"media/codec2/components/apv/C2SoftApvDec.cpp"}}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/15891c9875f6c8767e924cf374940183ec94c325"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-501467247.json"}}],"schema_version":"1.9.2"}