{"id":"ASB-A-514734206", "published":"2026-10-01T00:00:00Z", "modified":"2026-10-05T16:20:22.411518700Z", "aliases":["CVE-2026-58856", "A-514734206"], "details":"In returnOutputBufferLocked of DeprecatedCamera3StreamSplitter.cpp, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/av", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-10-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/0531a9faefb0c61a334ad9612d1eb6fa68a322b9"], "severity":"High", "spl":"2026-10-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"322297897645117140735027286792069434930", "length":748}, "id":"ASB-A-514734206-2141223d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/0531a9faefb0c61a334ad9612d1eb6fa68a322b9", "target":{"file":"services/camera/libcameraservice/device3/deprecated/DeprecatedCamera3StreamSplitter.cpp", "function":"DeprecatedCamera3StreamSplitter::returnOutputBufferLocked"}}, {"deprecated":false, "digest":{"line_hashes":["60792675138716393195126712884446077215", "207377364981501974618102428119944437929", "103045195241051488359009266297077325174", "248485275146170577519152926479068789092", "322485265681782058267305727727714388632", "108878171416752164336688240635815149716"], "threshold":0.9}, "id":"ASB-A-514734206-fc4b3493", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/0531a9faefb0c61a334ad9612d1eb6fa68a322b9", "target":{"file":"services/camera/libcameraservice/device3/deprecated/DeprecatedCamera3StreamSplitter.cpp"}}]}}, {"package":{"name":"platform/frameworks/av", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-10-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/349203358d1b697187c79f4728388de5ebf9bebb"], "severity":"High", "spl":"2026-10-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["60792675138716393195126712884446077215", "207377364981501974618102428119944437929", "103045195241051488359009266297077325174", "248485275146170577519152926479068789092", "322485265681782058267305727727714388632", "108878171416752164336688240635815149716"], "threshold":0.9}, "id":"ASB-A-514734206-2de8eb53", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/349203358d1b697187c79f4728388de5ebf9bebb", "target":{"file":"services/camera/libcameraservice/device3/Camera3StreamSplitter.cpp"}}, {"deprecated":false, "digest":{"function_hash":"334793293514043936055861835320349875338", "length":738}, "id":"ASB-A-514734206-d938bb82", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/349203358d1b697187c79f4728388de5ebf9bebb", "target":{"file":"services/camera/libcameraservice/device3/Camera3StreamSplitter.cpp", "function":"Camera3StreamSplitter::returnOutputBufferLocked"}}]}}, {"package":{"name":"platform/frameworks/av", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-10-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/cccf51c7b410495aa0c2afaa1fa868c6112fa961"], "severity":"High", "spl":"2026-10-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["60792675138716393195126712884446077215", "207377364981501974618102428119944437929", "103045195241051488359009266297077325174", "248485275146170577519152926479068789092", "322485265681782058267305727727714388632", "108878171416752164336688240635815149716"], "threshold":0.9}, "id":"ASB-A-514734206-9ab58b6b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/cccf51c7b410495aa0c2afaa1fa868c6112fa961", "target":{"file":"services/camera/libcameraservice/device3/deprecated/DeprecatedCamera3StreamSplitter.cpp"}}, {"deprecated":false, "digest":{"function_hash":"322297897645117140735027286792069434930", "length":748}, "id":"ASB-A-514734206-b70d7f85", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/cccf51c7b410495aa0c2afaa1fa868c6112fa961", "target":{"file":"services/camera/libcameraservice/device3/deprecated/DeprecatedCamera3StreamSplitter.cpp", "function":"DeprecatedCamera3StreamSplitter::returnOutputBufferLocked"}}]}}, {"package":{"name":"platform/frameworks/av", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-10-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/8fd6db9f14900cf81eef9eb7fa66b46aaa8d0b5a"], "severity":"High", "spl":"2026-10-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["60792675138716393195126712884446077215", "207377364981501974618102428119944437929", "103045195241051488359009266297077325174", "248485275146170577519152926479068789092", "322485265681782058267305727727714388632", "108878171416752164336688240635815149716"], "threshold":0.9}, "id":"ASB-A-514734206-c6de0f75", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/8fd6db9f14900cf81eef9eb7fa66b46aaa8d0b5a", "target":{"file":"services/camera/libcameraservice/device3/deprecated/DeprecatedCamera3StreamSplitter.cpp"}}, {"deprecated":false, "digest":{"function_hash":"322297897645117140735027286792069434930", "length":748}, "id":"ASB-A-514734206-d3924d50", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/8fd6db9f14900cf81eef9eb7fa66b46aaa8d0b5a", "target":{"file":"services/camera/libcameraservice/device3/deprecated/DeprecatedCamera3StreamSplitter.cpp", "function":"DeprecatedCamera3StreamSplitter::returnOutputBufferLocked"}}]}}, {"package":{"name":"platform/frameworks/av", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-10-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/cf6bc17a7eee898b7e2617cc4820e7e3c92f8c70"], "severity":"High", "spl":"2026-10-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"322297897645117140735027286792069434930", "length":748}, "id":"ASB-A-514734206-1755973a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/cf6bc17a7eee898b7e2617cc4820e7e3c92f8c70", "target":{"file":"services/camera/libcameraservice/device3/deprecated/DeprecatedCamera3StreamSplitter.cpp", "function":"DeprecatedCamera3StreamSplitter::returnOutputBufferLocked"}}, {"deprecated":false, "digest":{"line_hashes":["60792675138716393195126712884446077215", "207377364981501974618102428119944437929", "103045195241051488359009266297077325174", "248485275146170577519152926479068789092", "322485265681782058267305727727714388632", "108878171416752164336688240635815149716"], "threshold":0.9}, "id":"ASB-A-514734206-aa49d8b3", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/cf6bc17a7eee898b7e2617cc4820e7e3c92f8c70", "target":{"file":"services/camera/libcameraservice/device3/deprecated/DeprecatedCamera3StreamSplitter.cpp"}}]}}, {"package":{"name":"platform/frameworks/av", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-10-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/5ac22f00b723cfb2b5ff0babaf97afb31ea91358"], "severity":"High", "spl":"2026-10-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["60792675138716393195126712884446077215", "207377364981501974618102428119944437929", "103045195241051488359009266297077325174", "248485275146170577519152926479068789092", "322485265681782058267305727727714388632", "108878171416752164336688240635815149716"], "threshold":0.9}, "id":"ASB-A-514734206-51b4833b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/5ac22f00b723cfb2b5ff0babaf97afb31ea91358", "target":{"file":"services/camera/libcameraservice/device3/Camera3StreamSplitter.cpp"}}, {"deprecated":false, "digest":{"function_hash":"334793293514043936055861835320349875338", "length":738}, "id":"ASB-A-514734206-df5b7d4b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/5ac22f00b723cfb2b5ff0babaf97afb31ea91358", "target":{"file":"services/camera/libcameraservice/device3/Camera3StreamSplitter.cpp", "function":"Camera3StreamSplitter::returnOutputBufferLocked"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-10-01"}]}