{"id":"ASB-A-503554506", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-05T16:32:28.703711716Z", "aliases":["CVE-2026-58938", "A-503554506"], "details":"In parseChunk of MPEG4Extractor.cpp, there is a possible denial of service due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/av", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/4a06c37022b130d3b9a45ea4781e6e142105c0b9"], "severity":"High", "spl":"2026-11-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["197853634701172553368728275720051621009", "275459740048529036498998390427447209146", "277310317683338308521078393598523517715", "313445943890700643035053218805416695989", "5670419042888868238996599479184441969", "225339644912430636874633717905430626725", "145565958243807421434691674985599402799", "290120552944763958834689851951204001708", "220730873139715974071598356039413677464", "139427918136657076151569699659420100840", "177259696221667030164089490930128328852", "259267902869084839693035570705612266750", "203439370001377407443053918758319220725", "329980727218538627688940441060328315477", "71831706892328450256357906985165435596", "259267902869084839693035570705612266750"], "threshold":0.9}, "id":"ASB-A-503554506-46225ba8", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/4a06c37022b130d3b9a45ea4781e6e142105c0b9", "target":{"file":"media/module/extractors/mp4/MPEG4Extractor.cpp"}}, {"deprecated":false, "digest":{"function_hash":"273054221901529573438062365807222070800", "length":2884}, "id":"ASB-A-503554506-af7ac8e1", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/4a06c37022b130d3b9a45ea4781e6e142105c0b9", "target":{"file":"media/module/extractors/mp4/MPEG4Extractor.cpp", "function":"MPEG4Source::parseChunk"}}]}}, {"package":{"name":"platform/frameworks/av", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-11-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/8081930d2ef830b023f3f00b7964b5799ca8b703"], "severity":"High", "spl":"2026-11-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"32343667495205772354341300334496104842", "length":2827}, "id":"ASB-A-503554506-7ba1253f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/8081930d2ef830b023f3f00b7964b5799ca8b703", "target":{"file":"media/module/extractors/mp4/MPEG4Extractor.cpp", "function":"MPEG4Source::parseChunk"}}, {"deprecated":false, "digest":{"line_hashes":["197853634701172553368728275720051621009", "275459740048529036498998390427447209146", "277310317683338308521078393598523517715", "313445943890700643035053218805416695989", "5670419042888868238996599479184441969", "225339644912430636874633717905430626725", "145565958243807421434691674985599402799", "290120552944763958834689851951204001708", "220730873139715974071598356039413677464", "139427918136657076151569699659420100840", "177259696221667030164089490930128328852", "259267902869084839693035570705612266750", "24943371051801578220992389870191090030", "20428517157394807295029233389013236907", "9024935339055529939132111455609056178", "115730998638148463472856988700000852661", "33289148224649578035416649684096764494"], "threshold":0.9}, "id":"ASB-A-503554506-eb3ebcac", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/8081930d2ef830b023f3f00b7964b5799ca8b703", "target":{"file":"media/module/extractors/mp4/MPEG4Extractor.cpp"}}]}}, {"package":{"name":"platform/frameworks/av", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-11-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/66ab86ca1310fb15c4a715c9bb9306dc5b1a82ff"], "severity":"High", "spl":"2026-11-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["197853634701172553368728275720051621009", "275459740048529036498998390427447209146", "277310317683338308521078393598523517715", "313445943890700643035053218805416695989", "5670419042888868238996599479184441969", "225339644912430636874633717905430626725", "145565958243807421434691674985599402799", "290120552944763958834689851951204001708", "220730873139715974071598356039413677464", "139427918136657076151569699659420100840", "177259696221667030164089490930128328852", "259267902869084839693035570705612266750", "24943371051801578220992389870191090030", "20428517157394807295029233389013236907", "9024935339055529939132111455609056178", "115730998638148463472856988700000852661", "33289148224649578035416649684096764494"], "threshold":0.9}, "id":"ASB-A-503554506-02ba5e8c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/66ab86ca1310fb15c4a715c9bb9306dc5b1a82ff", "target":{"file":"media/module/extractors/mp4/MPEG4Extractor.cpp"}}, {"deprecated":false, "digest":{"function_hash":"32343667495205772354341300334496104842", "length":2827}, "id":"ASB-A-503554506-335cb0cd", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/66ab86ca1310fb15c4a715c9bb9306dc5b1a82ff", "target":{"file":"media/module/extractors/mp4/MPEG4Extractor.cpp", "function":"MPEG4Source::parseChunk"}}]}}, {"package":{"name":"platform/frameworks/av", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-11-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/695e66d7d1f0bebd9ed6b8d9fb48829465ab9375"], "severity":"High", "spl":"2026-11-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"32343667495205772354341300334496104842", "length":2827}, "id":"ASB-A-503554506-2e130741", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/695e66d7d1f0bebd9ed6b8d9fb48829465ab9375", "target":{"file":"media/module/extractors/mp4/MPEG4Extractor.cpp", "function":"MPEG4Source::parseChunk"}}, {"deprecated":false, "digest":{"line_hashes":["197853634701172553368728275720051621009", "275459740048529036498998390427447209146", "277310317683338308521078393598523517715", "313445943890700643035053218805416695989", "5670419042888868238996599479184441969", "225339644912430636874633717905430626725", "145565958243807421434691674985599402799", "290120552944763958834689851951204001708", "220730873139715974071598356039413677464", "139427918136657076151569699659420100840", "177259696221667030164089490930128328852", "259267902869084839693035570705612266750", "24943371051801578220992389870191090030", "20428517157394807295029233389013236907", "9024935339055529939132111455609056178", "115730998638148463472856988700000852661", "33289148224649578035416649684096764494"], "threshold":0.9}, "id":"ASB-A-503554506-40642d8c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/695e66d7d1f0bebd9ed6b8d9fb48829465ab9375", "target":{"file":"media/module/extractors/mp4/MPEG4Extractor.cpp"}}]}}, {"package":{"name":"platform/frameworks/av", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-11-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/17b93cf5001e8a37961677ca68fa9f7329dd4b28"], "severity":"High", "spl":"2026-11-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"273054221901529573438062365807222070800", "length":2884}, "id":"ASB-A-503554506-61b81ac0", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/17b93cf5001e8a37961677ca68fa9f7329dd4b28", "target":{"file":"media/module/extractors/mp4/MPEG4Extractor.cpp", "function":"MPEG4Source::parseChunk"}}, {"deprecated":false, "digest":{"line_hashes":["197853634701172553368728275720051621009", "275459740048529036498998390427447209146", "277310317683338308521078393598523517715", "313445943890700643035053218805416695989", "5670419042888868238996599479184441969", "225339644912430636874633717905430626725", "145565958243807421434691674985599402799", "290120552944763958834689851951204001708", "220730873139715974071598356039413677464", "139427918136657076151569699659420100840", "177259696221667030164089490930128328852", "259267902869084839693035570705612266750", "203439370001377407443053918758319220725", "329980727218538627688940441060328315477", "71831706892328450256357906985165435596", "259267902869084839693035570705612266750"], "threshold":0.9}, "id":"ASB-A-503554506-e6a6730b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/17b93cf5001e8a37961677ca68fa9f7329dd4b28", "target":{"file":"media/module/extractors/mp4/MPEG4Extractor.cpp"}}]}}, {"package":{"name":"platform/frameworks/av", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-11-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/e6c819ec6eda8decf0a840465de9e5156d1023ff"], "severity":"High", "spl":"2026-11-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["197853634701172553368728275720051621009", "275459740048529036498998390427447209146", "277310317683338308521078393598523517715", "313445943890700643035053218805416695989", "5670419042888868238996599479184441969", "225339644912430636874633717905430626725", "145565958243807421434691674985599402799", "290120552944763958834689851951204001708", "220730873139715974071598356039413677464", "139427918136657076151569699659420100840", "177259696221667030164089490930128328852", "259267902869084839693035570705612266750", "24943371051801578220992389870191090030", "20428517157394807295029233389013236907", "9024935339055529939132111455609056178", "115730998638148463472856988700000852661", "33289148224649578035416649684096764494"], "threshold":0.9}, "id":"ASB-A-503554506-c3e5da5b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/e6c819ec6eda8decf0a840465de9e5156d1023ff", "target":{"file":"media/module/extractors/mp4/MPEG4Extractor.cpp"}}, {"deprecated":false, "digest":{"function_hash":"32343667495205772354341300334496104842", "length":2827}, "id":"ASB-A-503554506-df610cff", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/e6c819ec6eda8decf0a840465de9e5156d1023ff", "target":{"file":"media/module/extractors/mp4/MPEG4Extractor.cpp", "function":"MPEG4Source::parseChunk"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}