CVE-2025-26455: Open Source Vulnerability in platform/frameworks/av - Heap Buffer Overflow in NdkMediaCodec
Summary
CVE-2025-26455: In multiple functions of NdkMediaCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow. Affects platform/frameworks/av across 4 version ranges.
>= 13:0, < 13:2025-06-01
>= 14:0, < 14:2025-06-01
>= 15:0, < 15:2025-06-01
>= 16-next:0, < 16-next:2025-06-01
Fixed in 16-next:2025-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The platform/frameworks/av package is a core component of the Android operating system, responsible for handling audio and video processing. It provides essential APIs for media playback and encoding, enabling developers to create rich multimedia applications. However, this package has been identified to have a critical vulnerability that could lead to severe security risks.
Vulnerability Detail
In multiple functions of NdkMediaCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow. This vulnerability can lead to local escalation of privilege without requiring additional execution privileges. The flaw originates from improper handling of memory buffers, which can be exploited by attackers to gain unauthorized access to system resources.
How To Fix
Minimum fixed version
16-next:2025-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate risks.
Conclusion
The vulnerability CVE-2025-26455 in the platform/frameworks/av package poses a significant risk due to a heap buffer overflow that can lead to local privilege escalation. It is crucial for developers to update their packages to the patched versions to safeguard their applications against potential exploitation.
See every vulnerability recorded for platform/frameworks/av →
FAQ
CVE-2025-26455 is a vulnerability in the platform/frameworks/av package that allows for a heap buffer overflow, potentially leading to local escalation of privilege.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to unauthorized access to system resources, which may compromise the security of the application and the device.
Yes, patches are available for various Android versions. Ensure to update to the latest fixed version to mitigate the vulnerability.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in your software, using just the gradle.lockfile.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/av.
