ASB-A-503554506

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-503554506.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-503554506
Aliases
  • A-503554506
  • CVE-2026-58938
Published
2026-11-01T00:00:00Z
Modified
2026-11-02T16:56:18Z
Summary
[none]
Details

In parseChunk of MPEG4Extractor.cpp, there is a possible denial of service due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android
platform/frameworks/av

Package

Name
platform/frameworks/av

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-qpr2-next:0
Fixed
17-qpr2-next:2026-11-01

Affected versions

Other
17-qpr2-next

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/av/+/4a06c37022b130d3b9a45ea4781e6e142105c0b9"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "DoS"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "197853634701172553368728275720051621009",
                    "275459740048529036498998390427447209146",
                    "277310317683338308521078393598523517715",
                    "313445943890700643035053218805416695989",
                    "5670419042888868238996599479184441969",
                    "225339644912430636874633717905430626725",
                    "145565958243807421434691674985599402799",
                    "290120552944763958834689851951204001708",
                    "220730873139715974071598356039413677464",
                    "139427918136657076151569699659420100840",
                    "177259696221667030164089490930128328852",
                    "259267902869084839693035570705612266750",
                    "203439370001377407443053918758319220725",
                    "329980727218538627688940441060328315477",
                    "71831706892328450256357906985165435596",
                    "259267902869084839693035570705612266750"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-503554506-46225ba8",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/av/+/4a06c37022b130d3b9a45ea4781e6e142105c0b9",
            "target":  {
                "file":  "media/module/extractors/mp4/MPEG4Extractor.cpp"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "273054221901529573438062365807222070800",
                "length":  2884
            },
            "id":  "ASB-A-503554506-af7ac8e1",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/av/+/4a06c37022b130d3b9a45ea4781e6e142105c0b9",
            "target":  {
                "file":  "media/module/extractors/mp4/MPEG4Extractor.cpp",
                "function":  "MPEG4Source::parseChunk"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-503554506.json"
platform/frameworks/av

Package

Name
platform/frameworks/av

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2026-11-01

Affected versions

Other
15

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/av/+/8081930d2ef830b023f3f00b7964b5799ca8b703"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "DoS"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "32343667495205772354341300334496104842",
                "length":  2827
            },
            "id":  "ASB-A-503554506-7ba1253f",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/av/+/8081930d2ef830b023f3f00b7964b5799ca8b703",
            "target":  {
                "file":  "media/module/extractors/mp4/MPEG4Extractor.cpp",
                "function":  "MPEG4Source::parseChunk"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "197853634701172553368728275720051621009",
                    "275459740048529036498998390427447209146",
                    "277310317683338308521078393598523517715",
                    "313445943890700643035053218805416695989",
                    "5670419042888868238996599479184441969",
                    "225339644912430636874633717905430626725",
                    "145565958243807421434691674985599402799",
                    "290120552944763958834689851951204001708",
                    "220730873139715974071598356039413677464",
                    "139427918136657076151569699659420100840",
                    "177259696221667030164089490930128328852",
                    "259267902869084839693035570705612266750",
                    "24943371051801578220992389870191090030",
                    "20428517157394807295029233389013236907",
                    "9024935339055529939132111455609056178",
                    "115730998638148463472856988700000852661",
                    "33289148224649578035416649684096764494"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-503554506-eb3ebcac",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/av/+/8081930d2ef830b023f3f00b7964b5799ca8b703",
            "target":  {
                "file":  "media/module/extractors/mp4/MPEG4Extractor.cpp"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-503554506.json"
platform/frameworks/av

Package

Name
platform/frameworks/av

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-11-01

Affected versions

Other
16

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/av/+/66ab86ca1310fb15c4a715c9bb9306dc5b1a82ff"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "DoS"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "197853634701172553368728275720051621009",
                    "275459740048529036498998390427447209146",
                    "277310317683338308521078393598523517715",
                    "313445943890700643035053218805416695989",
                    "5670419042888868238996599479184441969",
                    "225339644912430636874633717905430626725",
                    "145565958243807421434691674985599402799",
                    "290120552944763958834689851951204001708",
                    "220730873139715974071598356039413677464",
                    "139427918136657076151569699659420100840",
                    "177259696221667030164089490930128328852",
                    "259267902869084839693035570705612266750",
                    "24943371051801578220992389870191090030",
                    "20428517157394807295029233389013236907",
                    "9024935339055529939132111455609056178",
                    "115730998638148463472856988700000852661",
                    "33289148224649578035416649684096764494"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-503554506-02ba5e8c",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/av/+/66ab86ca1310fb15c4a715c9bb9306dc5b1a82ff",
            "target":  {
                "file":  "media/module/extractors/mp4/MPEG4Extractor.cpp"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "32343667495205772354341300334496104842",
                "length":  2827
            },
            "id":  "ASB-A-503554506-335cb0cd",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/av/+/66ab86ca1310fb15c4a715c9bb9306dc5b1a82ff",
            "target":  {
                "file":  "media/module/extractors/mp4/MPEG4Extractor.cpp",
                "function":  "MPEG4Source::parseChunk"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-503554506.json"
platform/frameworks/av

Package

Name
platform/frameworks/av

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-11-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/av/+/695e66d7d1f0bebd9ed6b8d9fb48829465ab9375"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "DoS"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "32343667495205772354341300334496104842",
                "length":  2827
            },
            "id":  "ASB-A-503554506-2e130741",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/av/+/695e66d7d1f0bebd9ed6b8d9fb48829465ab9375",
            "target":  {
                "file":  "media/module/extractors/mp4/MPEG4Extractor.cpp",
                "function":  "MPEG4Source::parseChunk"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "197853634701172553368728275720051621009",
                    "275459740048529036498998390427447209146",
                    "277310317683338308521078393598523517715",
                    "313445943890700643035053218805416695989",
                    "5670419042888868238996599479184441969",
                    "225339644912430636874633717905430626725",
                    "145565958243807421434691674985599402799",
                    "290120552944763958834689851951204001708",
                    "220730873139715974071598356039413677464",
                    "139427918136657076151569699659420100840",
                    "177259696221667030164089490930128328852",
                    "259267902869084839693035570705612266750",
                    "24943371051801578220992389870191090030",
                    "20428517157394807295029233389013236907",
                    "9024935339055529939132111455609056178",
                    "115730998638148463472856988700000852661",
                    "33289148224649578035416649684096764494"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-503554506-40642d8c",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/av/+/695e66d7d1f0bebd9ed6b8d9fb48829465ab9375",
            "target":  {
                "file":  "media/module/extractors/mp4/MPEG4Extractor.cpp"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-503554506.json"
platform/frameworks/av

Package

Name
platform/frameworks/av

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17:0
Fixed
17:2026-11-01

Affected versions

Other
17

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/av/+/17b93cf5001e8a37961677ca68fa9f7329dd4b28"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "DoS"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "273054221901529573438062365807222070800",
                "length":  2884
            },
            "id":  "ASB-A-503554506-61b81ac0",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/av/+/17b93cf5001e8a37961677ca68fa9f7329dd4b28",
            "target":  {
                "file":  "media/module/extractors/mp4/MPEG4Extractor.cpp",
                "function":  "MPEG4Source::parseChunk"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "197853634701172553368728275720051621009",
                    "275459740048529036498998390427447209146",
                    "277310317683338308521078393598523517715",
                    "313445943890700643035053218805416695989",
                    "5670419042888868238996599479184441969",
                    "225339644912430636874633717905430626725",
                    "145565958243807421434691674985599402799",
                    "290120552944763958834689851951204001708",
                    "220730873139715974071598356039413677464",
                    "139427918136657076151569699659420100840",
                    "177259696221667030164089490930128328852",
                    "259267902869084839693035570705612266750",
                    "203439370001377407443053918758319220725",
                    "329980727218538627688940441060328315477",
                    "71831706892328450256357906985165435596",
                    "259267902869084839693035570705612266750"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-503554506-e6a6730b",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/av/+/17b93cf5001e8a37961677ca68fa9f7329dd4b28",
            "target":  {
                "file":  "media/module/extractors/mp4/MPEG4Extractor.cpp"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-503554506.json"
platform/frameworks/av

Package

Name
platform/frameworks/av

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2026-11-01

Affected versions

Other
14

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/av/+/e6c819ec6eda8decf0a840465de9e5156d1023ff"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "DoS"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "197853634701172553368728275720051621009",
                    "275459740048529036498998390427447209146",
                    "277310317683338308521078393598523517715",
                    "313445943890700643035053218805416695989",
                    "5670419042888868238996599479184441969",
                    "225339644912430636874633717905430626725",
                    "145565958243807421434691674985599402799",
                    "290120552944763958834689851951204001708",
                    "220730873139715974071598356039413677464",
                    "139427918136657076151569699659420100840",
                    "177259696221667030164089490930128328852",
                    "259267902869084839693035570705612266750",
                    "24943371051801578220992389870191090030",
                    "20428517157394807295029233389013236907",
                    "9024935339055529939132111455609056178",
                    "115730998638148463472856988700000852661",
                    "33289148224649578035416649684096764494"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-503554506-c3e5da5b",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/av/+/e6c819ec6eda8decf0a840465de9e5156d1023ff",
            "target":  {
                "file":  "media/module/extractors/mp4/MPEG4Extractor.cpp"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "32343667495205772354341300334496104842",
                "length":  2827
            },
            "id":  "ASB-A-503554506-df610cff",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/av/+/e6c819ec6eda8decf0a840465de9e5156d1023ff",
            "target":  {
                "file":  "media/module/extractors/mp4/MPEG4Extractor.cpp",
                "function":  "MPEG4Source::parseChunk"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-503554506.json"