{"id":"ASB-A-514734206","details":"In returnOutputBufferLocked of DeprecatedCamera3StreamSplitter.cpp, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-514734206","CVE-2026-58856"],"modified":"2026-10-05T16:56:06.060735988Z","published":"2026-10-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-10-01"}],"affected":[{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-10-01"}]}],"versions":["17-next"],"ecosystem_specific":{"spl":"2026-10-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-514734206-2141223d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/0531a9faefb0c61a334ad9612d1eb6fa68a322b9","target":{"file":"services/camera/libcameraservice/device3/deprecated/DeprecatedCamera3StreamSplitter.cpp","function":"DeprecatedCamera3StreamSplitter::returnOutputBufferLocked"},"deprecated":false,"digest":{"function_hash":"322297897645117140735027286792069434930","length":748}},{"digest":{"line_hashes":["60792675138716393195126712884446077215","207377364981501974618102428119944437929","103045195241051488359009266297077325174","248485275146170577519152926479068789092","322485265681782058267305727727714388632","108878171416752164336688240635815149716"],"threshold":0.9},"id":"ASB-A-514734206-fc4b3493","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/0531a9faefb0c61a334ad9612d1eb6fa68a322b9","target":{"file":"services/camera/libcameraservice/device3/deprecated/DeprecatedCamera3StreamSplitter.cpp"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/0531a9faefb0c61a334ad9612d1eb6fa68a322b9"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-514734206.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-10-01"}]}],"versions":["15"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["60792675138716393195126712884446077215","207377364981501974618102428119944437929","103045195241051488359009266297077325174","248485275146170577519152926479068789092","322485265681782058267305727727714388632","108878171416752164336688240635815149716"],"threshold":0.9},"id":"ASB-A-514734206-2de8eb53","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/349203358d1b697187c79f4728388de5ebf9bebb","target":{"file":"services/camera/libcameraservice/device3/Camera3StreamSplitter.cpp"}},{"digest":{"function_hash":"334793293514043936055861835320349875338","length":738},"id":"ASB-A-514734206-d938bb82","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/349203358d1b697187c79f4728388de5ebf9bebb","target":{"file":"services/camera/libcameraservice/device3/Camera3StreamSplitter.cpp","function":"Camera3StreamSplitter::returnOutputBufferLocked"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/349203358d1b697187c79f4728388de5ebf9bebb"],"severity":"High","spl":"2026-10-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-514734206.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-10-01"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["60792675138716393195126712884446077215","207377364981501974618102428119944437929","103045195241051488359009266297077325174","248485275146170577519152926479068789092","322485265681782058267305727727714388632","108878171416752164336688240635815149716"]},"id":"ASB-A-514734206-9ab58b6b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/cccf51c7b410495aa0c2afaa1fa868c6112fa961","target":{"file":"services/camera/libcameraservice/device3/deprecated/DeprecatedCamera3StreamSplitter.cpp"},"deprecated":false},{"digest":{"length":748,"function_hash":"322297897645117140735027286792069434930"},"id":"ASB-A-514734206-b70d7f85","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/cccf51c7b410495aa0c2afaa1fa868c6112fa961","target":{"file":"services/camera/libcameraservice/device3/deprecated/DeprecatedCamera3StreamSplitter.cpp","function":"DeprecatedCamera3StreamSplitter::returnOutputBufferLocked"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/cccf51c7b410495aa0c2afaa1fa868c6112fa961"],"severity":"High","spl":"2026-10-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-514734206.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-10-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"severity":"High","spl":"2026-10-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["60792675138716393195126712884446077215","207377364981501974618102428119944437929","103045195241051488359009266297077325174","248485275146170577519152926479068789092","322485265681782058267305727727714388632","108878171416752164336688240635815149716"],"threshold":0.9},"id":"ASB-A-514734206-c6de0f75","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/8fd6db9f14900cf81eef9eb7fa66b46aaa8d0b5a","target":{"file":"services/camera/libcameraservice/device3/deprecated/DeprecatedCamera3StreamSplitter.cpp"}},{"id":"ASB-A-514734206-d3924d50","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/8fd6db9f14900cf81eef9eb7fa66b46aaa8d0b5a","target":{"function":"DeprecatedCamera3StreamSplitter::returnOutputBufferLocked","file":"services/camera/libcameraservice/device3/deprecated/DeprecatedCamera3StreamSplitter.cpp"},"deprecated":false,"digest":{"length":748,"function_hash":"322297897645117140735027286792069434930"}}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/8fd6db9f14900cf81eef9eb7fa66b46aaa8d0b5a"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-514734206.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-10-01"}]}],"versions":["17"],"ecosystem_specific":{"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/av/+/cf6bc17a7eee898b7e2617cc4820e7e3c92f8c70","target":{"file":"services/camera/libcameraservice/device3/deprecated/DeprecatedCamera3StreamSplitter.cpp","function":"DeprecatedCamera3StreamSplitter::returnOutputBufferLocked"},"deprecated":false,"digest":{"function_hash":"322297897645117140735027286792069434930","length":748},"id":"ASB-A-514734206-1755973a","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/cf6bc17a7eee898b7e2617cc4820e7e3c92f8c70","target":{"file":"services/camera/libcameraservice/device3/deprecated/DeprecatedCamera3StreamSplitter.cpp"},"deprecated":false,"digest":{"line_hashes":["60792675138716393195126712884446077215","207377364981501974618102428119944437929","103045195241051488359009266297077325174","248485275146170577519152926479068789092","322485265681782058267305727727714388632","108878171416752164336688240635815149716"],"threshold":0.9},"id":"ASB-A-514734206-aa49d8b3"}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/cf6bc17a7eee898b7e2617cc4820e7e3c92f8c70"],"severity":"High","spl":"2026-10-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-514734206.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-10-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2026-10-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["60792675138716393195126712884446077215","207377364981501974618102428119944437929","103045195241051488359009266297077325174","248485275146170577519152926479068789092","322485265681782058267305727727714388632","108878171416752164336688240635815149716"],"threshold":0.9},"id":"ASB-A-514734206-51b4833b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/5ac22f00b723cfb2b5ff0babaf97afb31ea91358","target":{"file":"services/camera/libcameraservice/device3/Camera3StreamSplitter.cpp"}},{"deprecated":false,"digest":{"function_hash":"334793293514043936055861835320349875338","length":738},"id":"ASB-A-514734206-df5b7d4b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/5ac22f00b723cfb2b5ff0babaf97afb31ea91358","target":{"file":"services/camera/libcameraservice/device3/Camera3StreamSplitter.cpp","function":"Camera3StreamSplitter::returnOutputBufferLocked"}}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/5ac22f00b723cfb2b5ff0babaf97afb31ea91358"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-514734206.json"}}],"schema_version":"1.9.0"}