EUVD-2026-74021
GHSA-276x-m8jj-77r6
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access with low privilege sufficient to invoke the HEVC decoder; no user interaction; privilege escalation achieves full device compromise with unchanged scope.
Primary rating from Vendor (android).
CVSS VectorVendor: android
Lifecycle Timeline
3DescriptionCVE.org
In ihevcd_get_tu_data_size of ihevcd_utils.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
AnalysisAI
Heap buffer overflow in Android's HEVC decoder (ihevcd_get_tu_data_size in ihevcd_utils.c) enables local privilege escalation across Android 14 through Android 17 with no additional execution privileges or user interaction required. A low-privileged attacker - such as a malicious application - can craft HEVC video input that triggers an out-of-bounds write on the heap, corrupting adjacent memory structures and ultimately gaining elevated device privileges. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a low-privileged process or application running locally on the affected Android device (AV:L, PR:L per CVSS) that can invoke the Android MediaCodec HEVC decoder - either by processing a crafted video file or by feeding malformed H.265 bitstream data into the decoder programmatically. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) is internally consistent and accurately reflects a local, low-complexity privilege escalation: an attacker needs only app-level execution on the target device, no special configuration, and no victim interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the security patches detailed in the Android Security Bulletin for September 2026 (https://source.android.com/docs/security/bulletin/2026/2026-09-01). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, alert IT and security teams to inventory all Android 14-17 devices in your environment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today