{"id":"ASB-A-506176085","details":"In multiple locations, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-506176085","CVE-2026-58975"],"modified":"2026-11-02T17:11:09.610015781Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/9efdc689acc68ed69010aa3d94e70f85df8ba0ee"],"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-506176085-0a4d531e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/9efdc689acc68ed69010aa3d94e70f85df8ba0ee","target":{"function":"LWOmxNode::getConfig","file":"media/libstagefright/omx/1.0/WOmxNode.cpp"},"deprecated":false,"digest":{"length":483,"function_hash":"281936828267491370053790045225554923847"}},{"id":"ASB-A-506176085-5b899265","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/9efdc689acc68ed69010aa3d94e70f85df8ba0ee","target":{"function":"LWOmxNode::getParameter","file":"media/libstagefright/omx/1.0/WOmxNode.cpp"},"deprecated":false,"digest":{"function_hash":"274235653066247670551857851246285094017","length":497}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/9efdc689acc68ed69010aa3d94e70f85df8ba0ee","target":{"file":"media/libstagefright/omx/1.0/WOmxNode.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["148787042774378258247855137538938698814","204693421834454279370393119136190749620","329691180599144309164636982350085358419","150091769942656804351869486237952497853","327790611192196305047353646609719672165","6962014915829942274513314664506400580","269461597714364693537417092845021016017","194200000706802391312169304746484324801","145264753436693884473711110208612830450","322811486022505592519322237749859635226","51312843083019906715032752288608079218","87570363989174029472257053835000697549","83727237841414454949495406574041970216"]},"id":"ASB-A-506176085-a28e9e6f","signature_type":"Line"},{"id":"ASB-A-506176085-c6b65039","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/9efdc689acc68ed69010aa3d94e70f85df8ba0ee","target":{"file":"media/libmedia/omx/1.0/WOmxNode.cpp","function":"LWOmxNode::getParameter"},"deprecated":false,"digest":{"function_hash":"274235653066247670551857851246285094017","length":497}},{"target":{"file":"media/libmedia/omx/1.0/WOmxNode.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["148787042774378258247855137538938698814","204693421834454279370393119136190749620","329691180599144309164636982350085358419","150091769942656804351869486237952497853","327790611192196305047353646609719672165","6962014915829942274513314664506400580","269461597714364693537417092845021016017","194200000706802391312169304746484324801","145264753436693884473711110208612830450","322811486022505592519322237749859635226","51312843083019906715032752288608079218","87570363989174029472257053835000697549","83727237841414454949495406574041970216"]},"id":"ASB-A-506176085-c6d8de6b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/9efdc689acc68ed69010aa3d94e70f85df8ba0ee"},{"digest":{"function_hash":"281936828267491370053790045225554923847","length":483},"id":"ASB-A-506176085-ec6efcab","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/9efdc689acc68ed69010aa3d94e70f85df8ba0ee","target":{"file":"media/libmedia/omx/1.0/WOmxNode.cpp","function":"LWOmxNode::getConfig"},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-506176085.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/3d8259129957ccad4f61fe244d0e964e2391caeb"],"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["148787042774378258247855137538938698814","204693421834454279370393119136190749620","329691180599144309164636982350085358419","150091769942656804351869486237952497853","327790611192196305047353646609719672165","6962014915829942274513314664506400580","269461597714364693537417092845021016017","194200000706802391312169304746484324801","145264753436693884473711110208612830450","322811486022505592519322237749859635226","51312843083019906715032752288608079218","87570363989174029472257053835000697549","83727237841414454949495406574041970216"]},"id":"ASB-A-506176085-27aea41e","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/3d8259129957ccad4f61fe244d0e964e2391caeb","target":{"file":"media/libstagefright/omx/1.0/WOmxNode.cpp"}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/3d8259129957ccad4f61fe244d0e964e2391caeb","target":{"file":"media/libstagefright/omx/1.0/WOmxNode.cpp","function":"LWOmxNode::getParameter"},"deprecated":false,"digest":{"function_hash":"274235653066247670551857851246285094017","length":497},"id":"ASB-A-506176085-2d259a3c"},{"source":"https://android.googlesource.com/platform/frameworks/av/+/3d8259129957ccad4f61fe244d0e964e2391caeb","target":{"function":"LWOmxNode::getParameter","file":"media/libmedia/omx/1.0/WOmxNode.cpp"},"deprecated":false,"digest":{"function_hash":"274235653066247670551857851246285094017","length":497},"id":"ASB-A-506176085-378e95be","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/3d8259129957ccad4f61fe244d0e964e2391caeb","target":{"file":"media/libmedia/omx/1.0/WOmxNode.cpp"},"deprecated":false,"digest":{"line_hashes":["148787042774378258247855137538938698814","204693421834454279370393119136190749620","329691180599144309164636982350085358419","150091769942656804351869486237952497853","327790611192196305047353646609719672165","6962014915829942274513314664506400580","269461597714364693537417092845021016017","194200000706802391312169304746484324801","145264753436693884473711110208612830450","322811486022505592519322237749859635226","51312843083019906715032752288608079218","87570363989174029472257053835000697549","83727237841414454949495406574041970216"],"threshold":0.9},"id":"ASB-A-506176085-60afdd4a","signature_type":"Line"},{"target":{"function":"LWOmxNode::getConfig","file":"media/libstagefright/omx/1.0/WOmxNode.cpp"},"deprecated":false,"digest":{"function_hash":"281936828267491370053790045225554923847","length":483},"id":"ASB-A-506176085-98bd8d88","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/3d8259129957ccad4f61fe244d0e964e2391caeb"},{"source":"https://android.googlesource.com/platform/frameworks/av/+/3d8259129957ccad4f61fe244d0e964e2391caeb","target":{"function":"LWOmxNode::getConfig","file":"media/libmedia/omx/1.0/WOmxNode.cpp"},"deprecated":false,"digest":{"function_hash":"281936828267491370053790045225554923847","length":483},"id":"ASB-A-506176085-f620c5fd","signature_type":"Function","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-506176085.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"281936828267491370053790045225554923847","length":483},"id":"ASB-A-506176085-26ea5cc2","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/f808d4eeb638eef13e4638d946d39023dfefda31","target":{"function":"LWOmxNode::getConfig","file":"media/libstagefright/omx/1.0/WOmxNode.cpp"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/f808d4eeb638eef13e4638d946d39023dfefda31","target":{"function":"LWOmxNode::getConfig","file":"media/libmedia/omx/1.0/WOmxNode.cpp"},"deprecated":false,"digest":{"function_hash":"281936828267491370053790045225554923847","length":483},"id":"ASB-A-506176085-3935eadb","signature_type":"Function"},{"id":"ASB-A-506176085-3f5fe176","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/f808d4eeb638eef13e4638d946d39023dfefda31","target":{"file":"media/libstagefright/omx/1.0/WOmxNode.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["148787042774378258247855137538938698814","204693421834454279370393119136190749620","329691180599144309164636982350085358419","150091769942656804351869486237952497853","327790611192196305047353646609719672165","6962014915829942274513314664506400580","269461597714364693537417092845021016017","194200000706802391312169304746484324801","145264753436693884473711110208612830450","322811486022505592519322237749859635226","51312843083019906715032752288608079218","87570363989174029472257053835000697549","83727237841414454949495406574041970216"]}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/f808d4eeb638eef13e4638d946d39023dfefda31","target":{"file":"media/libmedia/omx/1.0/WOmxNode.cpp","function":"LWOmxNode::getParameter"},"deprecated":false,"digest":{"function_hash":"274235653066247670551857851246285094017","length":497},"id":"ASB-A-506176085-7d6c20fa"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/f808d4eeb638eef13e4638d946d39023dfefda31","target":{"file":"media/libstagefright/omx/1.0/WOmxNode.cpp","function":"LWOmxNode::getParameter"},"deprecated":false,"digest":{"function_hash":"274235653066247670551857851246285094017","length":497},"id":"ASB-A-506176085-a77d254d","signature_type":"Function"},{"id":"ASB-A-506176085-bcb466e3","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/f808d4eeb638eef13e4638d946d39023dfefda31","target":{"file":"media/libmedia/omx/1.0/WOmxNode.cpp"},"deprecated":false,"digest":{"line_hashes":["148787042774378258247855137538938698814","204693421834454279370393119136190749620","329691180599144309164636982350085358419","150091769942656804351869486237952497853","327790611192196305047353646609719672165","6962014915829942274513314664506400580","269461597714364693537417092845021016017","194200000706802391312169304746484324801","145264753436693884473711110208612830450","322811486022505592519322237749859635226","51312843083019906715032752288608079218","87570363989174029472257053835000697549","83727237841414454949495406574041970216"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/f808d4eeb638eef13e4638d946d39023dfefda31"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-506176085.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"digest":{"line_hashes":["148787042774378258247855137538938698814","204693421834454279370393119136190749620","329691180599144309164636982350085358419","150091769942656804351869486237952497853","327790611192196305047353646609719672165","6962014915829942274513314664506400580","269461597714364693537417092845021016017","194200000706802391312169304746484324801","145264753436693884473711110208612830450","322811486022505592519322237749859635226","51312843083019906715032752288608079218","87570363989174029472257053835000697549","83727237841414454949495406574041970216"],"threshold":0.9},"id":"ASB-A-506176085-3489813b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/cbb28ecd7b07bd378f1315076b09afc9687b8cff","target":{"file":"media/libstagefright/omx/1.0/WOmxNode.cpp"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/cbb28ecd7b07bd378f1315076b09afc9687b8cff","target":{"file":"media/libmedia/omx/1.0/WOmxNode.cpp"},"deprecated":false,"digest":{"line_hashes":["148787042774378258247855137538938698814","204693421834454279370393119136190749620","329691180599144309164636982350085358419","150091769942656804351869486237952497853","327790611192196305047353646609719672165","6962014915829942274513314664506400580","269461597714364693537417092845021016017","194200000706802391312169304746484324801","145264753436693884473711110208612830450","322811486022505592519322237749859635226","51312843083019906715032752288608079218","87570363989174029472257053835000697549","83727237841414454949495406574041970216"],"threshold":0.9},"id":"ASB-A-506176085-37308e76"},{"source":"https://android.googlesource.com/platform/frameworks/av/+/cbb28ecd7b07bd378f1315076b09afc9687b8cff","target":{"function":"LWOmxNode::getConfig","file":"media/libstagefright/omx/1.0/WOmxNode.cpp"},"deprecated":false,"digest":{"function_hash":"281936828267491370053790045225554923847","length":483},"id":"ASB-A-506176085-98df6b5b","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/cbb28ecd7b07bd378f1315076b09afc9687b8cff","target":{"file":"media/libstagefright/omx/1.0/WOmxNode.cpp","function":"LWOmxNode::getParameter"},"deprecated":false,"digest":{"function_hash":"274235653066247670551857851246285094017","length":497},"id":"ASB-A-506176085-9c62242f"},{"source":"https://android.googlesource.com/platform/frameworks/av/+/cbb28ecd7b07bd378f1315076b09afc9687b8cff","target":{"file":"media/libmedia/omx/1.0/WOmxNode.cpp","function":"LWOmxNode::getParameter"},"deprecated":false,"digest":{"length":497,"function_hash":"274235653066247670551857851246285094017"},"id":"ASB-A-506176085-ba23a5c8","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"length":483,"function_hash":"281936828267491370053790045225554923847"},"id":"ASB-A-506176085-f591fe9e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/cbb28ecd7b07bd378f1315076b09afc9687b8cff","target":{"file":"media/libmedia/omx/1.0/WOmxNode.cpp","function":"LWOmxNode::getConfig"}}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/cbb28ecd7b07bd378f1315076b09afc9687b8cff"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-506176085.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-506176085-0aba115b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/3f1e6864b50e9a66df34e30a4452a08a96497de2","target":{"file":"media/libstagefright/omx/1.0/WOmxNode.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["148787042774378258247855137538938698814","204693421834454279370393119136190749620","329691180599144309164636982350085358419","150091769942656804351869486237952497853","327790611192196305047353646609719672165","6962014915829942274513314664506400580","269461597714364693537417092845021016017","194200000706802391312169304746484324801","145264753436693884473711110208612830450","322811486022505592519322237749859635226","51312843083019906715032752288608079218","87570363989174029472257053835000697549","83727237841414454949495406574041970216"]}},{"source":"https://android.googlesource.com/platform/frameworks/av/+/3f1e6864b50e9a66df34e30a4452a08a96497de2","target":{"file":"media/libmedia/omx/1.0/WOmxNode.cpp","function":"LWOmxNode::getConfig"},"deprecated":false,"digest":{"function_hash":"281936828267491370053790045225554923847","length":483},"id":"ASB-A-506176085-2e4d15ab","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"length":483,"function_hash":"281936828267491370053790045225554923847"},"id":"ASB-A-506176085-42227f0e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/3f1e6864b50e9a66df34e30a4452a08a96497de2","target":{"file":"media/libstagefright/omx/1.0/WOmxNode.cpp","function":"LWOmxNode::getConfig"}},{"digest":{"threshold":0.9,"line_hashes":["148787042774378258247855137538938698814","204693421834454279370393119136190749620","329691180599144309164636982350085358419","150091769942656804351869486237952497853","327790611192196305047353646609719672165","6962014915829942274513314664506400580","269461597714364693537417092845021016017","194200000706802391312169304746484324801","145264753436693884473711110208612830450","322811486022505592519322237749859635226","51312843083019906715032752288608079218","87570363989174029472257053835000697549","83727237841414454949495406574041970216"]},"id":"ASB-A-506176085-90644b51","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/3f1e6864b50e9a66df34e30a4452a08a96497de2","target":{"file":"media/libmedia/omx/1.0/WOmxNode.cpp"},"deprecated":false},{"target":{"function":"LWOmxNode::getParameter","file":"media/libmedia/omx/1.0/WOmxNode.cpp"},"deprecated":false,"digest":{"function_hash":"274235653066247670551857851246285094017","length":497},"id":"ASB-A-506176085-a72401ca","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/3f1e6864b50e9a66df34e30a4452a08a96497de2"},{"target":{"file":"media/libstagefright/omx/1.0/WOmxNode.cpp","function":"LWOmxNode::getParameter"},"deprecated":false,"digest":{"length":497,"function_hash":"274235653066247670551857851246285094017"},"id":"ASB-A-506176085-ef5b8cfe","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/3f1e6864b50e9a66df34e30a4452a08a96497de2"}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/3f1e6864b50e9a66df34e30a4452a08a96497de2"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-506176085.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"274235653066247670551857851246285094017","length":497},"id":"ASB-A-506176085-06fdd4bb","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/2482edfef88be0ac67febf9ce85910858a4d86ee","target":{"function":"LWOmxNode::getParameter","file":"media/libmedia/omx/1.0/WOmxNode.cpp"}},{"source":"https://android.googlesource.com/platform/frameworks/av/+/2482edfef88be0ac67febf9ce85910858a4d86ee","target":{"file":"media/libstagefright/omx/1.0/WOmxNode.cpp"},"deprecated":false,"digest":{"line_hashes":["148787042774378258247855137538938698814","204693421834454279370393119136190749620","329691180599144309164636982350085358419","150091769942656804351869486237952497853","327790611192196305047353646609719672165","6962014915829942274513314664506400580","269461597714364693537417092845021016017","194200000706802391312169304746484324801","145264753436693884473711110208612830450","322811486022505592519322237749859635226","51312843083019906715032752288608079218","87570363989174029472257053835000697549","83727237841414454949495406574041970216"],"threshold":0.9},"id":"ASB-A-506176085-488d8fc7","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["148787042774378258247855137538938698814","204693421834454279370393119136190749620","329691180599144309164636982350085358419","150091769942656804351869486237952497853","327790611192196305047353646609719672165","6962014915829942274513314664506400580","269461597714364693537417092845021016017","194200000706802391312169304746484324801","145264753436693884473711110208612830450","322811486022505592519322237749859635226","51312843083019906715032752288608079218","87570363989174029472257053835000697549","83727237841414454949495406574041970216"],"threshold":0.9},"id":"ASB-A-506176085-4cc6c8e2","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/2482edfef88be0ac67febf9ce85910858a4d86ee","target":{"file":"media/libmedia/omx/1.0/WOmxNode.cpp"}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/2482edfef88be0ac67febf9ce85910858a4d86ee","target":{"function":"LWOmxNode::getConfig","file":"media/libstagefright/omx/1.0/WOmxNode.cpp"},"deprecated":false,"digest":{"function_hash":"281936828267491370053790045225554923847","length":483},"id":"ASB-A-506176085-5767c4d8"},{"id":"ASB-A-506176085-89717f61","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/2482edfef88be0ac67febf9ce85910858a4d86ee","target":{"file":"media/libmedia/omx/1.0/WOmxNode.cpp","function":"LWOmxNode::getConfig"},"deprecated":false,"digest":{"function_hash":"281936828267491370053790045225554923847","length":483}},{"target":{"file":"media/libstagefright/omx/1.0/WOmxNode.cpp","function":"LWOmxNode::getParameter"},"deprecated":false,"digest":{"function_hash":"274235653066247670551857851246285094017","length":497},"id":"ASB-A-506176085-d49266a0","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/2482edfef88be0ac67febf9ce85910858a4d86ee"}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/2482edfef88be0ac67febf9ce85910858a4d86ee"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-506176085.json"}}],"schema_version":"1.9.2"}