{"id":"ASB-A-503551664", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-02T16:38:00.081625681Z", "aliases":["CVE-2026-58949", "A-503551664"], "details":"In parseMetaData of StagefrightMetadataRetriever.cpp, there is a possible denial of service due to a stack buffer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/av", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/8407b6db81e0ba453f9aaeea9557a6596c6077a1"], "severity":"High", "spl":"2026-11-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["212005156504006909810380826118477428738", "76929151031484328311568050513190920211", "276846406045173548284040415355858573974", "315178685278376487713881389909993347718"], "threshold":0.9}, "id":"ASB-A-503551664-0d5cf3f7", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/8407b6db81e0ba453f9aaeea9557a6596c6077a1", "target":{"file":"media/libmediaplayerservice/StagefrightMetadataRetriever.cpp"}}, {"deprecated":false, "digest":{"function_hash":"297537373219137393956183970971185909285", "length":7677}, "id":"ASB-A-503551664-b13d2872", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/8407b6db81e0ba453f9aaeea9557a6596c6077a1", "target":{"file":"media/libmediaplayerservice/StagefrightMetadataRetriever.cpp", "function":"StagefrightMetadataRetriever::parseMetaData"}}]}}, {"package":{"name":"platform/frameworks/av", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-11-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/dcbb4476931cccfc48cfb2342b4df57222d732fd"], "severity":"High", "spl":"2026-11-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"297537373219137393956183970971185909285", "length":7677}, "id":"ASB-A-503551664-8efe4f8b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/dcbb4476931cccfc48cfb2342b4df57222d732fd", "target":{"file":"media/libmediaplayerservice/StagefrightMetadataRetriever.cpp", "function":"StagefrightMetadataRetriever::parseMetaData"}}, {"deprecated":false, "digest":{"line_hashes":["212005156504006909810380826118477428738", "76929151031484328311568050513190920211", "276846406045173548284040415355858573974", "315178685278376487713881389909993347718"], "threshold":0.9}, "id":"ASB-A-503551664-beb155ff", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/dcbb4476931cccfc48cfb2342b4df57222d732fd", "target":{"file":"media/libmediaplayerservice/StagefrightMetadataRetriever.cpp"}}]}}, {"package":{"name":"platform/frameworks/av", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-11-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/c7bb0bb8dad0a7e7ef17eded9f55a761b968c8ec"], "severity":"High", "spl":"2026-11-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"297537373219137393956183970971185909285", "length":7677}, "id":"ASB-A-503551664-55f2c5e5", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/c7bb0bb8dad0a7e7ef17eded9f55a761b968c8ec", "target":{"file":"media/libmediaplayerservice/StagefrightMetadataRetriever.cpp", "function":"StagefrightMetadataRetriever::parseMetaData"}}, {"deprecated":false, "digest":{"line_hashes":["212005156504006909810380826118477428738", "76929151031484328311568050513190920211", "276846406045173548284040415355858573974", "315178685278376487713881389909993347718"], "threshold":0.9}, "id":"ASB-A-503551664-c48dadaf", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/c7bb0bb8dad0a7e7ef17eded9f55a761b968c8ec", "target":{"file":"media/libmediaplayerservice/StagefrightMetadataRetriever.cpp"}}]}}, {"package":{"name":"platform/frameworks/av", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-11-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/2854bdfa4bc22ad64d2ea91fa92817269ec92038"], "severity":"High", "spl":"2026-11-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["212005156504006909810380826118477428738", "76929151031484328311568050513190920211", "276846406045173548284040415355858573974", "315178685278376487713881389909993347718"], "threshold":0.9}, "id":"ASB-A-503551664-97a8ef8f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/2854bdfa4bc22ad64d2ea91fa92817269ec92038", "target":{"file":"media/libmediaplayerservice/StagefrightMetadataRetriever.cpp"}}, {"deprecated":false, "digest":{"function_hash":"297537373219137393956183970971185909285", "length":7677}, "id":"ASB-A-503551664-a45da6ee", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/2854bdfa4bc22ad64d2ea91fa92817269ec92038", "target":{"file":"media/libmediaplayerservice/StagefrightMetadataRetriever.cpp", "function":"StagefrightMetadataRetriever::parseMetaData"}}]}}, {"package":{"name":"platform/frameworks/av", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-11-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/bddf6679cdc3ab6f5a69e7fa0e8d78b5ea827eca"], "severity":"High", "spl":"2026-11-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"297537373219137393956183970971185909285", "length":7677}, "id":"ASB-A-503551664-35ef49dc", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/bddf6679cdc3ab6f5a69e7fa0e8d78b5ea827eca", "target":{"file":"media/libmediaplayerservice/StagefrightMetadataRetriever.cpp", "function":"StagefrightMetadataRetriever::parseMetaData"}}, {"deprecated":false, "digest":{"line_hashes":["212005156504006909810380826118477428738", "76929151031484328311568050513190920211", "276846406045173548284040415355858573974", "315178685278376487713881389909993347718"], "threshold":0.9}, "id":"ASB-A-503551664-3f377d1b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/bddf6679cdc3ab6f5a69e7fa0e8d78b5ea827eca", "target":{"file":"media/libmediaplayerservice/StagefrightMetadataRetriever.cpp"}}]}}, {"package":{"name":"platform/frameworks/av", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-11-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/a3275d1f2254f19e5d4eaef9270e32ebd6466da9"], "severity":"High", "spl":"2026-11-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["212005156504006909810380826118477428738", "76929151031484328311568050513190920211", "276846406045173548284040415355858573974", "315178685278376487713881389909993347718"], "threshold":0.9}, "id":"ASB-A-503551664-2e002abf", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/a3275d1f2254f19e5d4eaef9270e32ebd6466da9", "target":{"file":"media/libmediaplayerservice/StagefrightMetadataRetriever.cpp"}}, {"deprecated":false, "digest":{"function_hash":"172819048925493488861249326067958828741", "length":7433}, "id":"ASB-A-503551664-82d4670e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/a3275d1f2254f19e5d4eaef9270e32ebd6466da9", "target":{"file":"media/libmediaplayerservice/StagefrightMetadataRetriever.cpp", "function":"StagefrightMetadataRetriever::parseMetaData"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}