CVE-2026-58856: Out-of-Bounds Read Vulnerability in Android's platform/frameworks/av Package
Summary
CVE-2026-58856: In returnOutputBufferLocked of DeprecatedCamera3StreamSplitter.cpp, there is a possible out-of-bounds read due to a missing bounds check. Affects platform/frameworks/av across 6 version ranges.
>= 14:0, < 14:2026-10-01
>= 15:0, < 15:2026-10-01
>= 16:0, < 16:2026-10-01
>= 16-qpr2:0, < 16-qpr2:2026-10-01
>= 17:0, < 17:2026-10-01
>= 17-next:0, < 17-next:2026-10-01
Fixed in 17-next:2026-10-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The platform/frameworks/av package is a core component of the Android operating system, responsible for handling audio and video processing. It provides essential functionalities for multimedia applications, enabling them to capture, encode, decode, and render audio and video streams. This package is critical for applications that rely on camera and media playback features. The vulnerability in question arises from a flaw in the DeprecatedCamera3StreamSplitter component, which can lead to potential information disclosure.
Vulnerability Detail
In the DeprecatedCamera3StreamSplitter.cpp file, the function returnOutputBufferLocked lacks proper bounds checking, leading to a possible out-of-bounds read. This vulnerability can be exploited to disclose sensitive information from memory without requiring additional execution privileges. The issue is classified as a high-severity elevation of privilege (EoP) vulnerability, which means that it could allow an attacker to gain access to data that should be protected.
How To Fix
Minimum fixed version
17-next:2026-10-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for this vulnerability. It is recommended to apply the patch as soon as possible to mitigate the risk of exploitation.
Conclusion
The CVE-2026-58856 vulnerability in the Android platform/frameworks/av package poses a significant risk due to its potential for information disclosure. Users are strongly advised to update to the latest patched versions to ensure their applications remain secure.
See every vulnerability recorded for platform/frameworks/av →
FAQ
CVE-2026-58856 is a vulnerability in the Android platform/frameworks/av package that allows for an out-of-bounds read, potentially leading to information disclosure.
Exploitation of this vulnerability could allow attackers to access sensitive information from memory, which could compromise user privacy and security.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
While there are no specific workarounds, it is crucial to prioritize updating the package to the patched version to mitigate risks.
For real-time monitoring and alerts on open-source vulnerabilities, you can visit Vulert at https://vulert.com, which uses gradle.lockfile to track vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/av.
