{"id":"ASB-A-503551664","details":"In parseMetaData of StagefrightMetadataRetriever.cpp, there is a possible denial of service due to a stack buffer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-503551664","CVE-2026-58949"],"modified":"2026-11-02T17:11:17.789835358Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["DoS"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/8407b6db81e0ba453f9aaeea9557a6596c6077a1","target":{"file":"media/libmediaplayerservice/StagefrightMetadataRetriever.cpp"},"deprecated":false,"digest":{"line_hashes":["212005156504006909810380826118477428738","76929151031484328311568050513190920211","276846406045173548284040415355858573974","315178685278376487713881389909993347718"],"threshold":0.9},"id":"ASB-A-503551664-0d5cf3f7"},{"id":"ASB-A-503551664-b13d2872","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/8407b6db81e0ba453f9aaeea9557a6596c6077a1","target":{"file":"media/libmediaplayerservice/StagefrightMetadataRetriever.cpp","function":"StagefrightMetadataRetriever::parseMetaData"},"deprecated":false,"digest":{"function_hash":"297537373219137393956183970971185909285","length":7677}}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/8407b6db81e0ba453f9aaeea9557a6596c6077a1"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503551664.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"length":7677,"function_hash":"297537373219137393956183970971185909285"},"id":"ASB-A-503551664-8efe4f8b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/dcbb4476931cccfc48cfb2342b4df57222d732fd","target":{"file":"media/libmediaplayerservice/StagefrightMetadataRetriever.cpp","function":"StagefrightMetadataRetriever::parseMetaData"}},{"id":"ASB-A-503551664-beb155ff","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/dcbb4476931cccfc48cfb2342b4df57222d732fd","target":{"file":"media/libmediaplayerservice/StagefrightMetadataRetriever.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["212005156504006909810380826118477428738","76929151031484328311568050513190920211","276846406045173548284040415355858573974","315178685278376487713881389909993347718"]}}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/dcbb4476931cccfc48cfb2342b4df57222d732fd"],"severity":"High","spl":"2026-11-01","types":["DoS"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503551664.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"id":"ASB-A-503551664-55f2c5e5","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/c7bb0bb8dad0a7e7ef17eded9f55a761b968c8ec","target":{"file":"media/libmediaplayerservice/StagefrightMetadataRetriever.cpp","function":"StagefrightMetadataRetriever::parseMetaData"},"deprecated":false,"digest":{"length":7677,"function_hash":"297537373219137393956183970971185909285"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/c7bb0bb8dad0a7e7ef17eded9f55a761b968c8ec","target":{"file":"media/libmediaplayerservice/StagefrightMetadataRetriever.cpp"},"deprecated":false,"digest":{"line_hashes":["212005156504006909810380826118477428738","76929151031484328311568050513190920211","276846406045173548284040415355858573974","315178685278376487713881389909993347718"],"threshold":0.9},"id":"ASB-A-503551664-c48dadaf","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/c7bb0bb8dad0a7e7ef17eded9f55a761b968c8ec"],"severity":"High","spl":"2026-11-01","types":["DoS"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503551664.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/2854bdfa4bc22ad64d2ea91fa92817269ec92038","target":{"file":"media/libmediaplayerservice/StagefrightMetadataRetriever.cpp"},"deprecated":false,"digest":{"line_hashes":["212005156504006909810380826118477428738","76929151031484328311568050513190920211","276846406045173548284040415355858573974","315178685278376487713881389909993347718"],"threshold":0.9},"id":"ASB-A-503551664-97a8ef8f","signature_type":"Line"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/2854bdfa4bc22ad64d2ea91fa92817269ec92038","target":{"file":"media/libmediaplayerservice/StagefrightMetadataRetriever.cpp","function":"StagefrightMetadataRetriever::parseMetaData"},"deprecated":false,"digest":{"length":7677,"function_hash":"297537373219137393956183970971185909285"},"id":"ASB-A-503551664-a45da6ee","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/2854bdfa4bc22ad64d2ea91fa92817269ec92038"],"severity":"High","spl":"2026-11-01","types":["DoS"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503551664.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"spl":"2026-11-01","types":["DoS"],"vanir_signatures":[{"id":"ASB-A-503551664-35ef49dc","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/bddf6679cdc3ab6f5a69e7fa0e8d78b5ea827eca","target":{"function":"StagefrightMetadataRetriever::parseMetaData","file":"media/libmediaplayerservice/StagefrightMetadataRetriever.cpp"},"deprecated":false,"digest":{"length":7677,"function_hash":"297537373219137393956183970971185909285"}},{"id":"ASB-A-503551664-3f377d1b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/bddf6679cdc3ab6f5a69e7fa0e8d78b5ea827eca","target":{"file":"media/libmediaplayerservice/StagefrightMetadataRetriever.cpp"},"deprecated":false,"digest":{"line_hashes":["212005156504006909810380826118477428738","76929151031484328311568050513190920211","276846406045173548284040415355858573974","315178685278376487713881389909993347718"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/bddf6679cdc3ab6f5a69e7fa0e8d78b5ea827eca"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503551664.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["212005156504006909810380826118477428738","76929151031484328311568050513190920211","276846406045173548284040415355858573974","315178685278376487713881389909993347718"]},"id":"ASB-A-503551664-2e002abf","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/a3275d1f2254f19e5d4eaef9270e32ebd6466da9","target":{"file":"media/libmediaplayerservice/StagefrightMetadataRetriever.cpp"}},{"target":{"function":"StagefrightMetadataRetriever::parseMetaData","file":"media/libmediaplayerservice/StagefrightMetadataRetriever.cpp"},"deprecated":false,"digest":{"function_hash":"172819048925493488861249326067958828741","length":7433},"id":"ASB-A-503551664-82d4670e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/a3275d1f2254f19e5d4eaef9270e32ebd6466da9"}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/a3275d1f2254f19e5d4eaef9270e32ebd6466da9"],"severity":"High","spl":"2026-11-01","types":["DoS"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503551664.json"}}],"schema_version":"1.9.2"}