EUVD-2026-92616
GHSA-66qg-cw3j-3wqq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall or compromise low-privileged app
-
ExploitInvoke affected camera buffer path
-
ExecutionTrigger out-of-bounds read in returnOutputBufferLocked
-
ImpactDisclose adjacent process memory
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local code execution on the device: an attacker must already have a low-privileged app installed and running (PR:L) that can reach the DeprecatedCamera3StreamSplitter code path handling camera output buffers. No user interaction is needed (UI:N) and no remote access is possible (AV:L). Limiting factors: the attacker must get code onto the device first, exploitation yields only a partial memory read (C:L) with no write/control, and it is confined to Android versions 14 through 17 (including 16-qpr2); the 'Deprecated' camera splitter implementation may further narrow which configurations or devices actually exercise this path. |
| Impact | This is a genuinely low-severity, low-priority issue despite being in the ubiquitous Android platform. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 3.3) describes a local, low-privilege, out-of-bounds read yielding only partial confidentiality impact with no integrity or availability effect, and no scope change. The SSVC decision framework corroborates low urgency: Exploitation='none' (no observed or public exploitation), Automatable='no', and Technical Impact='partial'. There is no CISA KEV listing and no POC referenced in the provided data, and no EPSS score was supplied - absence of EPSS is a data gap, not a signal. All signals are mutually consistent: a local information-disclosure bug requiring an already-present low-privileged app, not a remotely weaponizable flaw. The one caveat is that the C:L rating means only limited memory contents leak, so real-world value to an attacker is marginal and would typically serve as a minor aid (e.g., defeating ASLR) rather than a standalone threat. |
| Exploit ScenarioDerived | A malicious or compromised app already installed on an Android device with low privileges invokes the affected camera stream-splitter code path, triggering the missing bounds check in returnOutputBufferLocked to read adjacent out-of-bounds memory. The leaked bytes could expose fragments of process memory useful for further attack staging. No public exploit code was identified in the provided data, and no user interaction is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
An out-of-bounds read in Android's camera3 stream splitter (DeprecatedCamera3StreamSplitter.cpp, returnOutputBufferLocked) lets a locally installed, low-privileged application read a small amount of adjacent process memory while camera output buffers are being returned, potentially disclosing limited information on Android 14, 15, 16, 16-qpr2, and 17. The flaw is a missing bounds check reachable only from local code already running on the device (CVSS 3.1 base 3.3, AV:L/PR:L/UI:N, C:L/I:N/A:N), and no public exploit identified at time of analysis, with SSVC assessing exploitation as 'none' and not automatable. The issue is fixed in the October 2026 Android Security Bulletin (2026-10-01) patch level, and this is a genuinely low-severity, low-priority issue despite being in the ubiquitous Android platform.
RemediationAI
The primary fix is to apply the Android Security Bulletin dated 2026-10-01 (October 2026) - patch availability is confirmed per the vendor advisory, but no exact patched build or version string is enumerated in the provided data, so administrators should track the bulletin's patch-level identifiers for Android 14, 15, 16, 16-qpr2, and 17 and confirm that OEM/carrier builds carry a security patch level of 2026-10-01 or later. Because exploitation requires a local, low-privileged app to already be running on the device, the most effective pre-patch compensating controls are application-supply-chain controls: restrict sideloading and unknown-source installs, enforce Google Play Protect or an equivalent mobile threat defense, and remove or block untrusted applications - with the trade-off that this reduces user flexibility and does not stop a pre-installed or system-integrated malicious component. Administrators can also revoke the camera permission from non-essential applications or run untrusted apps inside a work profile with camera access denied, accepting the functional cost that those apps lose legitimate camera functionality; note that this is a partial mitigation, since any component retaining camera access may still reach the vulnerable buffer-return path. Network-side controls such as MDM policy enforcement and camera-disabling profiles offer limited value here because the attack is entirely local, and no code-execution or privilege-escalation rebound is expected given the C:L/I:N/A:N impact profile.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Android camera framework's camera3 stream splitter, specifically the legacy implementation in DeprecatedCamera3StreamSplitter.cpp. The stream splitter takes a single camera output buffer produced by the camera HAL and duplicates it into multiple consumer streams (for example, preview, recording, and analysis surfaces); the returnOutputBufferLocked function handles returning a completed output buffer to the producer. A missing bounds check in that path allows a read past the end of the buffer, which classifies under CWE-119 (improper restriction of operations within the bounds of a memory buffer) - a generic parent class encompassing out-of-bounds read/write conditions such as CWE-125. Because the primitive is a read only, the consequence is memory disclosure rather than memory corruption: the CVSS impact is C:L with I:N/A:N, so integrity and availability of the device are unaffected. Reachability requires code executing locally on the device with the ability to reach the camera output-buffer path (PR:L), and no user interaction is needed (UI:N); there is no remote attack vector (AV:L). The 'Deprecated' designation in the filename indicates this splitter is a legacy code path, which may further narrow which device configurations and camera HAL versions actually exercise it.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Local-only OOB read reachable by an already-installed low-privileged app (AV:L, PR:L), no user interaction, limited memory leak gives C:L with no integrity or availability impact.
Primary rating from Vendor (google_android).
CVSS VectorVendor: google_android
Lifecycle Timeline
3DescriptionCVE.org
In returnOutputBufferLocked of DeprecatedCamera3StreamSplitter.cpp, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB