CVE-2026-56997

CVE-2026-56997 is an out-of-bounds write (CWE-787) caused by a missing bounds check in the Av1DecodeFrameTag function of vp9hwd_headers.cc, part of a VP9/AV1 video decoder component in the Google-assigned codebase. A remote attacker can trigger the flaw by supplying a maliciously crafted video stream or codec frame headers to an application or device that uses the vulnerable decoder, with no user interaction required. Successful exploitation leads to remote escalation of privilege in the decoder's process context with high impact to confidentiality, integrity, and availability (CVSS 3.1: 8.8). The flaw was assigned by Google's vulnerability management team, indicating it likely ships in a Google-maintained product such as the Android media stack or a Chromium-based platform, though the advisory data does not name specific products or fixed versions. There is no known public proof of concept, the issue is not on the CISA KEV list, and no exploitation in the wild has been reported.

What to do: Apply Google's security updates as soon as they are released for the affected component (e.g., the monthly Android security bulletin or Chrome/ChromeOS update channel) since exploitation requires no user interaction. Device vendors and app developers who statically link or bundle this decoder should pull the patched source and rebuild. Until patched, monitor for crashes or anomalous memory corruption in media/codec playback paths, and treat unsolicited or untrusted video content from untrusted sources as higher risk.