{"id":"ASB-A-486464711", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-05T16:32:28.703711716Z", "aliases":["CVE-2026-58868", "A-486464711"], "details":"In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/av", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/7d328ec5b7320f067d38955a3a0e23b7c16d8dfd"], "severity":"Critical", "spl":"2026-11-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"14971058762342113222987035164005125676", "length":2761}, "id":"ASB-A-486464711-0d7fc3ce", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/7d328ec5b7320f067d38955a3a0e23b7c16d8dfd", "target":{"file":"media/libstagefright/FrameDecoder.cpp", "function":"MediaImageDecoder::onOutputReceived"}}, {"deprecated":false, "digest":{"line_hashes":["56148501091498996342373282339934476820", "332818756163477779612561436932838179261", "62751261081472084587792854915437327889"], "threshold":0.9}, "id":"ASB-A-486464711-71872de5", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/7d328ec5b7320f067d38955a3a0e23b7c16d8dfd", "target":{"file":"media/libstagefright/FrameDecoder.cpp"}}]}}, {"package":{"name":"platform/frameworks/av", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-11-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/732be4b49e2defb57e3b360e5b014162439a8903"], "severity":"Critical", "spl":"2026-11-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["56148501091498996342373282339934476820", "332818756163477779612561436932838179261", "62751261081472084587792854915437327889"], "threshold":0.9}, "id":"ASB-A-486464711-2a188166", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/732be4b49e2defb57e3b360e5b014162439a8903", "target":{"file":"media/libstagefright/FrameDecoder.cpp"}}, {"deprecated":false, "digest":{"function_hash":"282399388958571951614906666657160321856", "length":2813}, "id":"ASB-A-486464711-d1b977af", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/732be4b49e2defb57e3b360e5b014162439a8903", "target":{"file":"media/libstagefright/FrameDecoder.cpp", "function":"MediaImageDecoder::onOutputReceived"}}]}}, {"package":{"name":"platform/frameworks/av", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-11-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/10dec31735cdf6bc8e4923d9b8a862b0e6f10138"], "severity":"Critical", "spl":"2026-11-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["56148501091498996342373282339934476820", "332818756163477779612561436932838179261", "62751261081472084587792854915437327889"], "threshold":0.9}, "id":"ASB-A-486464711-92ccfcd3", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/10dec31735cdf6bc8e4923d9b8a862b0e6f10138", "target":{"file":"media/libstagefright/FrameDecoder.cpp"}}, {"deprecated":false, "digest":{"function_hash":"14971058762342113222987035164005125676", "length":2761}, "id":"ASB-A-486464711-d9c250fd", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/10dec31735cdf6bc8e4923d9b8a862b0e6f10138", "target":{"file":"media/libstagefright/FrameDecoder.cpp", "function":"MediaImageDecoder::onOutputReceived"}}]}}, {"package":{"name":"platform/frameworks/av", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-11-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/4945faf5ae316f27e039d8d9b6cc7b721228c479"], "severity":"Critical", "spl":"2026-11-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"14971058762342113222987035164005125676", "length":2761}, "id":"ASB-A-486464711-09a8c4f5", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/4945faf5ae316f27e039d8d9b6cc7b721228c479", "target":{"file":"media/libstagefright/FrameDecoder.cpp", "function":"MediaImageDecoder::onOutputReceived"}}, {"deprecated":false, "digest":{"line_hashes":["56148501091498996342373282339934476820", "332818756163477779612561436932838179261", "62751261081472084587792854915437327889"], "threshold":0.9}, "id":"ASB-A-486464711-102000b9", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/4945faf5ae316f27e039d8d9b6cc7b721228c479", "target":{"file":"media/libstagefright/FrameDecoder.cpp"}}]}}, {"package":{"name":"platform/frameworks/av", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-11-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/7d5206d539e9ddf011c25d189d090aa3b3aa9cf7"], "severity":"Critical", "spl":"2026-11-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"14971058762342113222987035164005125676", "length":2761}, "id":"ASB-A-486464711-1598fab7", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/7d5206d539e9ddf011c25d189d090aa3b3aa9cf7", "target":{"file":"media/libstagefright/FrameDecoder.cpp", "function":"MediaImageDecoder::onOutputReceived"}}, {"deprecated":false, "digest":{"line_hashes":["56148501091498996342373282339934476820", "332818756163477779612561436932838179261", "62751261081472084587792854915437327889"], "threshold":0.9}, "id":"ASB-A-486464711-d9c39001", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/7d5206d539e9ddf011c25d189d090aa3b3aa9cf7", "target":{"file":"media/libstagefright/FrameDecoder.cpp"}}]}}, {"package":{"name":"platform/frameworks/av", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-11-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/a90252279e95af31ea3515e7495f635f03049b75"], "severity":"Critical", "spl":"2026-11-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["56148501091498996342373282339934476820", "332818756163477779612561436932838179261", "62751261081472084587792854915437327889"], "threshold":0.9}, "id":"ASB-A-486464711-68c60125", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/a90252279e95af31ea3515e7495f635f03049b75", "target":{"file":"media/libstagefright/FrameDecoder.cpp"}}, {"deprecated":false, "digest":{"function_hash":"282399388958571951614906666657160321856", "length":2813}, "id":"ASB-A-486464711-daa30565", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/a90252279e95af31ea3515e7495f635f03049b75", "target":{"file":"media/libstagefright/FrameDecoder.cpp", "function":"MediaImageDecoder::onOutputReceived"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}