CVE-2026-55294

CVE-2026-55294 is a heap-based buffer overflow (out-of-bounds write, CWE-122) in the function ihevcd_get_tu_data_size in ihevcd_utils.c, part of Android's HEVC video decoder (assigned by the Android security team). It is triggered when the decoder processes HEVC-coded media data in a way that makes the transform-unit data-size computation write past the bounds of an allocated heap buffer, and exploitation requires no user interaction. A local attacker with no additional privileges who can get the vulnerable decoder to process malicious HEVC content gains local escalation of privilege, with high impact on confidentiality, integrity, and availability per the CVSS score. Affected parties are Android devices running builds that contain the vulnerable decoder component; the provided data does not specify which Android version ranges are impacted. No public proof of concept is known, the issue is not in CISA's KEV catalog, and EPSS assigns only a 0.1% probability of exploitation within 30 days, so no exploitation has been observed.

What to do: Track the Android Security Bulletin and apply the OEM security update that includes this fix as soon as it becomes available, then verify the device's Android security patch level. Because this is a local privilege escalation requiring no user interaction, prioritize patching shared or multi-user Android devices; until patched, limit processing of HEVC media from untrusted local sources where feasible.