ASB-A-514734206

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-514734206.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-514734206
Aliases
  • A-514734206
  • CVE-2026-58856
Published
2026-10-01T00:00:00Z
Modified
2026-10-05T16:56:06Z
Summary
[none]
Details

In returnOutputBufferLocked of DeprecatedCamera3StreamSplitter.cpp, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android
platform/frameworks/av

Package

Name
platform/frameworks/av

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-next:0
Fixed
17-next:2026-10-01

Affected versions

Other
17-next

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/av/+/0531a9faefb0c61a334ad9612d1eb6fa68a322b9"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "322297897645117140735027286792069434930",
                "length":  748
            },
            "id":  "ASB-A-514734206-2141223d",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/av/+/0531a9faefb0c61a334ad9612d1eb6fa68a322b9",
            "target":  {
                "file":  "services/camera/libcameraservice/device3/deprecated/DeprecatedCamera3StreamSplitter.cpp",
                "function":  "DeprecatedCamera3StreamSplitter::returnOutputBufferLocked"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "60792675138716393195126712884446077215",
                    "207377364981501974618102428119944437929",
                    "103045195241051488359009266297077325174",
                    "248485275146170577519152926479068789092",
                    "322485265681782058267305727727714388632",
                    "108878171416752164336688240635815149716"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-514734206-fc4b3493",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/av/+/0531a9faefb0c61a334ad9612d1eb6fa68a322b9",
            "target":  {
                "file":  "services/camera/libcameraservice/device3/deprecated/DeprecatedCamera3StreamSplitter.cpp"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-514734206.json"
platform/frameworks/av

Package

Name
platform/frameworks/av

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2026-10-01

Affected versions

Other
15

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/av/+/349203358d1b697187c79f4728388de5ebf9bebb"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "60792675138716393195126712884446077215",
                    "207377364981501974618102428119944437929",
                    "103045195241051488359009266297077325174",
                    "248485275146170577519152926479068789092",
                    "322485265681782058267305727727714388632",
                    "108878171416752164336688240635815149716"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-514734206-2de8eb53",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/av/+/349203358d1b697187c79f4728388de5ebf9bebb",
            "target":  {
                "file":  "services/camera/libcameraservice/device3/Camera3StreamSplitter.cpp"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "334793293514043936055861835320349875338",
                "length":  738
            },
            "id":  "ASB-A-514734206-d938bb82",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/av/+/349203358d1b697187c79f4728388de5ebf9bebb",
            "target":  {
                "file":  "services/camera/libcameraservice/device3/Camera3StreamSplitter.cpp",
                "function":  "Camera3StreamSplitter::returnOutputBufferLocked"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-514734206.json"
platform/frameworks/av

Package

Name
platform/frameworks/av

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-10-01

Affected versions

Other
16

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/av/+/cccf51c7b410495aa0c2afaa1fa868c6112fa961"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "60792675138716393195126712884446077215",
                    "207377364981501974618102428119944437929",
                    "103045195241051488359009266297077325174",
                    "248485275146170577519152926479068789092",
                    "322485265681782058267305727727714388632",
                    "108878171416752164336688240635815149716"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-514734206-9ab58b6b",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/av/+/cccf51c7b410495aa0c2afaa1fa868c6112fa961",
            "target":  {
                "file":  "services/camera/libcameraservice/device3/deprecated/DeprecatedCamera3StreamSplitter.cpp"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "322297897645117140735027286792069434930",
                "length":  748
            },
            "id":  "ASB-A-514734206-b70d7f85",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/av/+/cccf51c7b410495aa0c2afaa1fa868c6112fa961",
            "target":  {
                "file":  "services/camera/libcameraservice/device3/deprecated/DeprecatedCamera3StreamSplitter.cpp",
                "function":  "DeprecatedCamera3StreamSplitter::returnOutputBufferLocked"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-514734206.json"
platform/frameworks/av

Package

Name
platform/frameworks/av

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-10-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/av/+/8fd6db9f14900cf81eef9eb7fa66b46aaa8d0b5a"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "60792675138716393195126712884446077215",
                    "207377364981501974618102428119944437929",
                    "103045195241051488359009266297077325174",
                    "248485275146170577519152926479068789092",
                    "322485265681782058267305727727714388632",
                    "108878171416752164336688240635815149716"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-514734206-c6de0f75",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/av/+/8fd6db9f14900cf81eef9eb7fa66b46aaa8d0b5a",
            "target":  {
                "file":  "services/camera/libcameraservice/device3/deprecated/DeprecatedCamera3StreamSplitter.cpp"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "322297897645117140735027286792069434930",
                "length":  748
            },
            "id":  "ASB-A-514734206-d3924d50",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/av/+/8fd6db9f14900cf81eef9eb7fa66b46aaa8d0b5a",
            "target":  {
                "file":  "services/camera/libcameraservice/device3/deprecated/DeprecatedCamera3StreamSplitter.cpp",
                "function":  "DeprecatedCamera3StreamSplitter::returnOutputBufferLocked"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-514734206.json"
platform/frameworks/av

Package

Name
platform/frameworks/av

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17:0
Fixed
17:2026-10-01

Affected versions

Other
17

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/av/+/cf6bc17a7eee898b7e2617cc4820e7e3c92f8c70"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "322297897645117140735027286792069434930",
                "length":  748
            },
            "id":  "ASB-A-514734206-1755973a",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/av/+/cf6bc17a7eee898b7e2617cc4820e7e3c92f8c70",
            "target":  {
                "file":  "services/camera/libcameraservice/device3/deprecated/DeprecatedCamera3StreamSplitter.cpp",
                "function":  "DeprecatedCamera3StreamSplitter::returnOutputBufferLocked"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "60792675138716393195126712884446077215",
                    "207377364981501974618102428119944437929",
                    "103045195241051488359009266297077325174",
                    "248485275146170577519152926479068789092",
                    "322485265681782058267305727727714388632",
                    "108878171416752164336688240635815149716"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-514734206-aa49d8b3",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/av/+/cf6bc17a7eee898b7e2617cc4820e7e3c92f8c70",
            "target":  {
                "file":  "services/camera/libcameraservice/device3/deprecated/DeprecatedCamera3StreamSplitter.cpp"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-514734206.json"
platform/frameworks/av

Package

Name
platform/frameworks/av

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2026-10-01

Affected versions

Other
14

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/av/+/5ac22f00b723cfb2b5ff0babaf97afb31ea91358"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "60792675138716393195126712884446077215",
                    "207377364981501974618102428119944437929",
                    "103045195241051488359009266297077325174",
                    "248485275146170577519152926479068789092",
                    "322485265681782058267305727727714388632",
                    "108878171416752164336688240635815149716"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-514734206-51b4833b",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/av/+/5ac22f00b723cfb2b5ff0babaf97afb31ea91358",
            "target":  {
                "file":  "services/camera/libcameraservice/device3/Camera3StreamSplitter.cpp"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "334793293514043936055861835320349875338",
                "length":  738
            },
            "id":  "ASB-A-514734206-df5b7d4b",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/av/+/5ac22f00b723cfb2b5ff0babaf97afb31ea91358",
            "target":  {
                "file":  "services/camera/libcameraservice/device3/Camera3StreamSplitter.cpp",
                "function":  "Camera3StreamSplitter::returnOutputBufferLocked"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-514734206.json"