EUVD-2026-115610
GHSA-4xxj-q6w6-xppc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted APV media to device
-
ExploitMedia framework invokes C2SoftApvDec decoder
-
ExecutionLogic error causes out-of-bounds read
-
ImpactLeak adjacent heap memory contents
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the device's Android media stack to decode an attacker-supplied APV (Advanced Professional Video) stream using the software decoder C2SoftApvDec; the flaw is a logic error leading to an out-of-bounds read in that component. The CVSS vector states no privileges and no user interaction (PR:N/UI:N), implying an automatic decode path, but in practice the attacker must get the crafted media in front of that decoder (e.g. via messaging, web, or media app). Limiting factors: impact is confined to information disclosure (C:L; no write, no code execution), and only Android 16, 16-qpr2, and 17 are listed as affected. |
| Impact | This is a moderate-severity information-disclosure flaw (CVSS 5.3, C:L only, no integrity or availability impact) in the Android software APV video decoder (C2SoftApvDec.cpp). The CVSS vector (AV:N/AC:L/PR:N/UI:N) and the description agree that exploitation is remote, low-complexity, unauthenticated, and requires no user interaction, which on Android typically means a crafted APV media stream can be processed automatically. However, the real-world risk signals are consistently low-to-moderate: EPSS is 0.17% (6th percentile), there is no CISA KEV listing, and no public exploit reference is present in the input. The vuln.today decision label is 'this_month' (routine prioritization), not act_now or emergency. The impact ceiling is also limited - an out-of-bounds read (CWE-125) leaks small amounts of adjacent memory rather than granting code execution. One caveat worth verifying: the vector asserts AV:N/UI:N, but as a media-codec bug the practical trigger is the victim's device decoding attacker-supplied APV content, so 'no user interaction' depends on an automatic decode path (e.g. preview/thumbnail/messaging) rather than the user explicitly opening a file. Overall this is a genuine but non-urgent patch-in-cycle issue, not a high-priority emergency. |
| Exploit ScenarioDerived | An attacker crafts a malformed APV-encoded video that, when parsed by Android's C2SoftApvDec software decoder, triggers an out-of-bounds read and leaks adjacent process memory back to the attacker or into accessible output. The content could be delivered where it is decoded automatically (messaging preview, web/media playback), consistent with the AV:N/UI:N vector. No public exploit was identified at time of analysis, so this scenario is inferred from the CWE-125 description and CVSS metrics. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
An out-of-bounds read in the Android software APV (Advanced Professional Video) decoder implemented in C2SoftApvDec.cpp lets remote attackers disclose limited device memory by getting a crafted APV stream decoded on the device. The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3) requires no privileges and no user interaction, although the attacker must still place the malicious media in front of that decoder through a messaging, web, or media-app path. Impact is confined to confidentiality (C:L) with no integrity or availability effect; Android 16, Android 16-QPR2, and Android 17 are listed as affected, EPSS is low at 0.17% (6th percentile), and no public exploit has been identified at time of analysis.
RemediationAI
Apply the Android security update referenced by the Android Security Bulletin of 2026-11-01 (https://source.android.com/docs/security/bulletin/2026/2026-11-01), which is the vendor-published fix channel for this decoder defect; the provided data does not enumerate specific build or patch identifiers, so confirm the bulletin's device build table for the exact patched release for each affected branch (Android 16, Android 16-QPR2, Android 17). No workaround, feature toggle, or configuration-based mitigation for disabling the APV software decoder is stated in the available sources, and because exploitation requires only that a crafted APV stream be decoded, the security bulletin update is the complete remediation path described. Until the platform update is installed on a device, exposure is limited to information disclosure (no code execution, integrity, or availability impact), and no public exploit has been identified at time of analysis; prioritization can follow the this_month decision label, the low EPSS of 0.17%, and the absence of CISA KEV listing.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-125 (out-of-bounds read) arising from a logic error in C2SoftApvDec.cpp, part of Android's software implementation of the APV codec - a professional-grade intra-frame video codec that Android 16 and later support for high-bitrate recording and playback. Because the decoder is a software component in the media stack, parsing of an attacker-supplied bitstream happens in the media decoding process rather than in a privileged system service, which is consistent with the assessed scope (S:U) and purely informational impact. The CVE record and the independent assessment both describe a logic error rather than a memory-write primitive; the exact malformed field and the precise decoding stage that triggers the out-of-bounds read are not described in the available sources. CPE data attributes the issue to google:android as a platform-wide entry rather than to a standalone library, so the exposure surface is the platform decoder shipped on the affected Android releases.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Crafted APV media can reach the decoder remotely with no auth or interaction (AV:N/PR:N/UI:N); an out-of-bounds read yields limited info disclosure only (C:L, I:N, A:N).
Primary rating from Vendor (google_android).
CVSS VectorVendor: google_android
Lifecycle Timeline
3DescriptionCVE.org
In process of C2SoftApvDec.cpp, there is a possible out-of-bounds read due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB