CVE-2026-56920

CVE-2026-56920 is an out-of-bounds write (CWE-787) caused by a logic error in s_decode_vui_param(), a function in the HEVC (H.265) video decoder source file fw_hevc_dec_header.c, assigned by Google's Android security team. The flaw is triggered when the decoder parses the Video Usability Information (VUI) section of a maliciously crafted HEVC bitstream, writing beyond the intended buffer and corrupting memory. Successful exploitation can yield remote code execution in the media-decoding process with no user interaction required and high impact to confidentiality, integrity, and availability (CVSS 3.1: 8.8); the PR:L rating indicates the attacker still needs some level of prior access or privilege, such as the ability to deliver media via an app or remote stream. Any device shipping the vulnerable HEVC decoder component is potentially affected, though the provided data does not enumerate specific builds or version ranges, so the corresponding Android/vendor bulletin should be consulted. No public proof-of-concept exists, the CVE is not on CISA's KEV list, and no exploitation in the wild has been reported.

What to do: Roll out the Android security update that patches this CVE to all managed Android devices as the primary mitigation, since exploitation requires no user interaction. Device manufacturers and ROM maintainers should confirm their codec builds incorporate the fixed fw_hevc_dec source. Review devices or apps that process HEVC/H.265 media from untrusted sources (messaging attachments, third-party streaming clients) and monitor per-model patch availability in vendor bulletins.