CVE-2026-58710

An out-of-bounds write (CWE-120) exists in the DecodeFilmGrainParams() function of film_grain_dec.cc in Google's libgav1 open-source AV1 decoder, caused by a missing bounds check when parsing film-grain metadata from an encoded AV1 bitstream. An attacker triggers the flaw by supplying a maliciously crafted AV1 video to any application or system component that decodes AV1 with the vulnerable library, with no user interaction required. Successful exploitation can yield remote code execution within the decoder's process (CVSS 3.1: 8.8), impacting confidentiality, integrity, and availability of that process's data. The CVE was assigned by Google's device security vulnerability management team, and libgav1 is widely deployed as Android's platform software AV1 decoder, so Android devices and third-party products embedding libgav1 are potentially affected, although the advisory does not state specific affected version ranges. There is no known public proof of concept and the flaw is not listed in CISA's KEV catalog.

What to do: Apply the vendor patch as soon as it appears in the relevant Android security bulletin or upstream libgav1 release, prioritizing devices and apps that decode untrusted AV1 content. If you embed libgav1 directly in a product, rebuild against the fixed upstream commit and verify media decoding runs in a sandboxed, least-privileged process. Monitor for crashes in media/codec processes as a potential indicator and ensure no privileged service decodes attacker-supplied AV1 streams.