Separate libhevc Android out-of-bounds read disclosed as ZDI-26-969
Original title: ZDI-26-969: libhevc HEVC Video Decoder Out-Of-Bounds Read Information Disclosure Vulnerability
Like the companion notice, this one is CVSS 4.4 and needs a malicious page or file.
ZDI published ZDI-26-969, another out-of-bounds read in the libhevc HEVC decoder on Google Android. A remote attacker can disclose sensitive information when a user visits a malicious page or opens a malicious file. ZDI rates it CVSS 4.4, with no CVE or fix named in the snippet.
Unconfirmed: The snippet does not state whether this is a distinct bug from ZDI-26-970, or whether it is patched.
- The advisory identifier is ZDI-26-969.
- The component named is the libhevc HEVC video decoder.
- No affected Android release or fixed build is given.
Impact: Disclosure of sensitive information
| Product | Affected |
|---|---|
| Google Android | — |
- Vendors
- Organizations
- Zero Day Initiative
From the original article
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Google Android. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 4.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.