ASB-A-486464711

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-486464711.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-486464711
Aliases
  • A-486464711
  • CVE-2026-58868
Published
2026-11-01T00:00:00Z
Modified
2026-11-02T16:56:25Z
Summary
[none]
Details

In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android
platform/frameworks/av

Package

Name
platform/frameworks/av

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-qpr2-next:0
Fixed
17-qpr2-next:2026-11-01

Affected versions

Other
17-qpr2-next

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/av/+/7d328ec5b7320f067d38955a3a0e23b7c16d8dfd"
    ],
    "severity":  "Critical",
    "spl":  "2026-11-01",
    "types":  [
        "RCE"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "14971058762342113222987035164005125676",
                "length":  2761
            },
            "id":  "ASB-A-486464711-0d7fc3ce",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/av/+/7d328ec5b7320f067d38955a3a0e23b7c16d8dfd",
            "target":  {
                "file":  "media/libstagefright/FrameDecoder.cpp",
                "function":  "MediaImageDecoder::onOutputReceived"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "56148501091498996342373282339934476820",
                    "332818756163477779612561436932838179261",
                    "62751261081472084587792854915437327889"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-486464711-71872de5",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/av/+/7d328ec5b7320f067d38955a3a0e23b7c16d8dfd",
            "target":  {
                "file":  "media/libstagefright/FrameDecoder.cpp"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-486464711.json"
platform/frameworks/av

Package

Name
platform/frameworks/av

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2026-11-01

Affected versions

Other
15

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/av/+/732be4b49e2defb57e3b360e5b014162439a8903"
    ],
    "severity":  "Critical",
    "spl":  "2026-11-01",
    "types":  [
        "RCE"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "56148501091498996342373282339934476820",
                    "332818756163477779612561436932838179261",
                    "62751261081472084587792854915437327889"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-486464711-2a188166",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/av/+/732be4b49e2defb57e3b360e5b014162439a8903",
            "target":  {
                "file":  "media/libstagefright/FrameDecoder.cpp"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "282399388958571951614906666657160321856",
                "length":  2813
            },
            "id":  "ASB-A-486464711-d1b977af",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/av/+/732be4b49e2defb57e3b360e5b014162439a8903",
            "target":  {
                "file":  "media/libstagefright/FrameDecoder.cpp",
                "function":  "MediaImageDecoder::onOutputReceived"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-486464711.json"
platform/frameworks/av

Package

Name
platform/frameworks/av

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-11-01

Affected versions

Other
16

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/av/+/10dec31735cdf6bc8e4923d9b8a862b0e6f10138"
    ],
    "severity":  "Critical",
    "spl":  "2026-11-01",
    "types":  [
        "RCE"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "56148501091498996342373282339934476820",
                    "332818756163477779612561436932838179261",
                    "62751261081472084587792854915437327889"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-486464711-92ccfcd3",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/av/+/10dec31735cdf6bc8e4923d9b8a862b0e6f10138",
            "target":  {
                "file":  "media/libstagefright/FrameDecoder.cpp"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "14971058762342113222987035164005125676",
                "length":  2761
            },
            "id":  "ASB-A-486464711-d9c250fd",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/av/+/10dec31735cdf6bc8e4923d9b8a862b0e6f10138",
            "target":  {
                "file":  "media/libstagefright/FrameDecoder.cpp",
                "function":  "MediaImageDecoder::onOutputReceived"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-486464711.json"
platform/frameworks/av

Package

Name
platform/frameworks/av

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-11-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/av/+/4945faf5ae316f27e039d8d9b6cc7b721228c479"
    ],
    "severity":  "Critical",
    "spl":  "2026-11-01",
    "types":  [
        "RCE"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "14971058762342113222987035164005125676",
                "length":  2761
            },
            "id":  "ASB-A-486464711-09a8c4f5",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/av/+/4945faf5ae316f27e039d8d9b6cc7b721228c479",
            "target":  {
                "file":  "media/libstagefright/FrameDecoder.cpp",
                "function":  "MediaImageDecoder::onOutputReceived"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "56148501091498996342373282339934476820",
                    "332818756163477779612561436932838179261",
                    "62751261081472084587792854915437327889"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-486464711-102000b9",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/av/+/4945faf5ae316f27e039d8d9b6cc7b721228c479",
            "target":  {
                "file":  "media/libstagefright/FrameDecoder.cpp"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-486464711.json"
platform/frameworks/av

Package

Name
platform/frameworks/av

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17:0
Fixed
17:2026-11-01

Affected versions

Other
17

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/av/+/7d5206d539e9ddf011c25d189d090aa3b3aa9cf7"
    ],
    "severity":  "Critical",
    "spl":  "2026-11-01",
    "types":  [
        "RCE"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "14971058762342113222987035164005125676",
                "length":  2761
            },
            "id":  "ASB-A-486464711-1598fab7",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/av/+/7d5206d539e9ddf011c25d189d090aa3b3aa9cf7",
            "target":  {
                "file":  "media/libstagefright/FrameDecoder.cpp",
                "function":  "MediaImageDecoder::onOutputReceived"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "56148501091498996342373282339934476820",
                    "332818756163477779612561436932838179261",
                    "62751261081472084587792854915437327889"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-486464711-d9c39001",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/av/+/7d5206d539e9ddf011c25d189d090aa3b3aa9cf7",
            "target":  {
                "file":  "media/libstagefright/FrameDecoder.cpp"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-486464711.json"
platform/frameworks/av

Package

Name
platform/frameworks/av

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2026-11-01

Affected versions

Other
14

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/av/+/a90252279e95af31ea3515e7495f635f03049b75"
    ],
    "severity":  "Critical",
    "spl":  "2026-11-01",
    "types":  [
        "RCE"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "56148501091498996342373282339934476820",
                    "332818756163477779612561436932838179261",
                    "62751261081472084587792854915437327889"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-486464711-68c60125",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/av/+/a90252279e95af31ea3515e7495f635f03049b75",
            "target":  {
                "file":  "media/libstagefright/FrameDecoder.cpp"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "282399388958571951614906666657160321856",
                "length":  2813
            },
            "id":  "ASB-A-486464711-daa30565",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/av/+/a90252279e95af31ea3515e7495f635f03049b75",
            "target":  {
                "file":  "media/libstagefright/FrameDecoder.cpp",
                "function":  "MediaImageDecoder::onOutputReceived"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-486464711.json"