ZDI details two Android libhevc HEVC decoder information leaks
What's new
First merged summary.
Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI
ZDI published two CVSS 4.4 out-of-bounds read flaws in Android’s libhevc decoder; no CVE or fix is named.
On November 13, 2026, ZDI published ZDI-26-969 and ZDI-26-970, companion out-of-bounds read information-disclosure flaws in the libhevc HEVC video decoder on Google Android. A remote attacker can disclose sensitive information if a user visits a malicious page or opens a malicious file. ZDI rates both CVSS 4.4. The published snippets name no CVE, affected Android release, fixed build, or patch.
Key facts
- Advisories are ZDI-26-969 and ZDI-26-970, both published November 13, 2026.
- Both are out-of-bounds reads in the libhevc HEVC video decoder.
- Each is rated CVSS 4.4 and can disclose sensitive information.
- Exploitation requires a user to visit a malicious page or open a malicious file.
- Snippets name no CVE, affected Android release, fixed build, or patch.
Timeline
dated events in the reporting · oldest first- Nov 13, 2026ZDI publishes ZDI-26-969 and ZDI-26-970 for libhevc. · ZDI Published Advisories
What each outlet adds
beyond the shared facts- ZDI Published AdvisoriesNames both ZDI IDs, CVSS 4.4, and the user-interaction trigger.
- Vendors
- Organizations
- Zero Day Initiative
Coverage
oldest first · one row per article · UTC- · 1d ago
ZDI Published AdvisoriesFirst report
Separate libhevc Android out-of-bounds read disclosed as ZDI-26-969
Like the companion notice, this one is CVSS 4.4 and needs a malicious page or file.
- · 1d ago
libhevc out-of-bounds read can disclose data on Android
ZDI-26-970 is rated CVSS 4.4 and requires a malicious page or file; no CVE is named.