CVE-2026-28618

CVE-2026-28618 is a heap buffer overflow in the dec_frm_prepare function of oapv.c, part of the OpenAPV (APV) video decoder shipped in Android, which allows an out-of-bounds write while preparing frame buffers for decoding. The flaw is triggered by processing maliciously crafted APV video bitstream data, and per the Android bulletin no user interaction and no additional execution privileges are required to exploit it. A successful attack yields remote code execution in the context of the affected media component. Affected parties are Android devices whose builds include the OpenAPV decoder (and any products embedding the liboapv code); the fix ships in the September 2026 Android security update, though specific affected version ranges are not provided in the source data. There is no known public proof-of-concept, the issue is not in CISA KEV, and EPSS assigns a low 0.2% probability of exploitation within 30 days, indicating no known exploitation at this time.

What to do: Apply the September 2026 Android security update (or later) as soon as your device or fleet's OEM delivers it, and verify the installed security patch level afterward. As an interim mitigation, avoid opening or decoding untrusted APV-encoded video content from unverified sources. Embedded-product maintainers who ship the OpenAPV liboapv code should check for and integrate the upstream fix.