ASB-A-503554745

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-503554745.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-503554745
Aliases
  • A-503554745
  • CVE-2026-58968
Published
2026-11-01T00:00:00Z
Modified
2026-11-02T16:56:13Z
Summary
[none]
Details

In oapvd_vlc_metadata of oapv_vlc.c, there is a possible memory corruption due to a double free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / platform/external/libopenapv

Package

Name
platform/external/libopenapv

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-11-01

Affected versions

Other
16

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/external/libopenapv/+/f536a67643d4851b914b783bc95c87a73113c2ce",
        "https://android.googlesource.com/platform/external/libopenapv/+/fdcd322e4b704dcda2e0d1c32b59abe2d9dd8b5f"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "201303214646010586295759483797106767487",
                "length":  299
            },
            "id":  "ASB-A-503554745-1e8165d0",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/libopenapv/+/f536a67643d4851b914b783bc95c87a73113c2ce",
            "target":  {
                "file":  "src/oapv_bs.c",
                "function":  "oapv_bsr_sink"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "329688334822125548632723255542873377280",
                    "189456381591763891566130812177474906361",
                    "93402738009925726122062146632625935919",
                    "107608026716922933207039920816896761940"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-503554745-4a4d9d66",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/libopenapv/+/f536a67643d4851b914b783bc95c87a73113c2ce",
            "target":  {
                "file":  "src/oapv_bs.c"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "230076127358975264884407718029065968402",
                    "202995181539553327420092200130985939409",
                    "114578174906390556358433123145888846233",
                    "178514980710874903557678017239902323204",
                    "76057062488678131394769025020900500577",
                    "322723349113177349289272210658254809288",
                    "5587964888767094763528297753968962712",
                    "57990567793989587109370002159788393186",
                    "139359143493208897181075862164233096398",
                    "96223400614845762027613963462815098266",
                    "199338700962562116827225829765324681969"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-503554745-5af5e9a2",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/libopenapv/+/f536a67643d4851b914b783bc95c87a73113c2ce",
            "target":  {
                "file":  "src/oapv_metadata.c"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "286213084988438290243283534297442420359",
                    "122157316390697067947458025860282130684",
                    "234348155013966107944835254946437676360",
                    "193525755139037911124000743241928402708",
                    "262514107822624185292453628694688264616",
                    "129393409311204570570131257718031784284"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-503554745-5fb08305",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/libopenapv/+/fdcd322e4b704dcda2e0d1c32b59abe2d9dd8b5f",
            "target":  {
                "file":  "src/oapv_vlc.c"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "146816756047489772205043204057628166596",
                "length":  1430
            },
            "id":  "ASB-A-503554745-66d1e254",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/libopenapv/+/f536a67643d4851b914b783bc95c87a73113c2ce",
            "target":  {
                "file":  "src/oapv_metadata.c",
                "function":  "oapvm_set"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "324506131128272204043502082651497723757",
                    "228230079987595779974564114585078201646",
                    "261443872063985884664744248046050100122",
                    "17178821834227421625745811157390089520",
                    "224792335837763642671463252701935035888",
                    "151977020742757620003235795547671589982",
                    "27751247280951175688467319543902693041",
                    "143040254249346777647975654294173610548",
                    "200017537696391552793127371139565950375",
                    "21059446723394328546686114587366865997",
                    "65652527676964515241670800476045214474",
                    "154777357648383594196522328233323225820",
                    "286994155769836653715172031573760741776",
                    "317510153499491830788021757970492975731",
                    "301799995285327332839365308057159323600",
                    "40867404971767023610316524340561897945",
                    "163389843326032839257497941464087592875",
                    "42008063841400989516025925235595964169",
                    "137606654269472491107879415686217245101",
                    "220331036710657773108637580588904983965",
                    "188448071366477388393834813946842781974",
                    "77537349742459107668129633034613267378",
                    "315179475238397659361285888159307024568",
                    "62922760383126728097131554115260148823",
                    "150088443070884854584310971105823280658",
                    "296549393933108464681326141783499538248",
                    "59710123991322340180820647544198425152",
                    "327124335541557247562110612746844919573",
                    "236156700550594620298814488420722853807",
                    "276765078350791320263698088741701350997",
                    "192598356018444971962266939251003851605",
                    "28601919181571391880287355600118708228"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-503554745-85359dfd",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/libopenapv/+/f536a67643d4851b914b783bc95c87a73113c2ce",
            "target":  {
                "file":  "src/oapv_vlc.c"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "340042431665104166925359131024762029396",
                "length":  1694
            },
            "id":  "ASB-A-503554745-c0e40c5c",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/libopenapv/+/f536a67643d4851b914b783bc95c87a73113c2ce",
            "target":  {
                "file":  "src/oapv_vlc.c",
                "function":  "oapvd_vlc_metadata"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "228816079958339004993177943394615936957",
                "length":  1533
            },
            "id":  "ASB-A-503554745-caf1468c",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/libopenapv/+/fdcd322e4b704dcda2e0d1c32b59abe2d9dd8b5f",
            "target":  {
                "file":  "src/oapv_vlc.c",
                "function":  "oapvd_vlc_metadata"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "299074011018476729950647226579448689968",
                "length":  625
            },
            "id":  "ASB-A-503554745-cd18ef88",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/libopenapv/+/f536a67643d4851b914b783bc95c87a73113c2ce",
            "target":  {
                "file":  "src/oapv_metadata.c",
                "function":  "meta_verify_mdp_data"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-503554745.json"

Android / platform/external/libopenapv

Package

Name
platform/external/libopenapv

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-11-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/external/libopenapv/+/c9eecb3c4d6471f093036b3e5e56227cbfe96621"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "286213084988438290243283534297442420359",
                    "122157316390697067947458025860282130684",
                    "234348155013966107944835254946437676360",
                    "193525755139037911124000743241928402708",
                    "262514107822624185292453628694688264616",
                    "129393409311204570570131257718031784284"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-503554745-4adeb9ea",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/libopenapv/+/c9eecb3c4d6471f093036b3e5e56227cbfe96621",
            "target":  {
                "file":  "src/oapv_vlc.c"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "228816079958339004993177943394615936957",
                "length":  1533
            },
            "id":  "ASB-A-503554745-c6fdc874",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/external/libopenapv/+/c9eecb3c4d6471f093036b3e5e56227cbfe96621",
            "target":  {
                "file":  "src/oapv_vlc.c",
                "function":  "oapvd_vlc_metadata"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-503554745.json"

Android / platform/external/libopenapv

Package

Name
platform/external/libopenapv

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17:0
Fixed
17:2026-11-01

Affected versions

Other
17

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/external/libopenapv/+/8541da2c50be2190616ed9abaeea2c34f2aecedc"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-503554745.json"