{"id":"CVE-2026-14918","kind":"vulnerability","aliases":["CVE-2026-14918"],"related":[],"title":"Signed Video Framework: out-of-bounds read can crash validation tools","description":"The Signed Video Framework contained a out-of-bounds read issue in the Signed Video Framework which could lead the application using this framework to crash. The issue exclusively affects the tools used for the validation of signed content. The AXIS OS device's signed video functionality remains unaffected.","summary":"The Signed Video Framework has an out-of-bounds read that can crash an application using it while it validates signed content. The sources say the issue affects only the tools that validate signed video, and that the AXIS OS device's signed video functionality is unaffected.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["axis-os","infrastructure","signed-video-framework"],"not_affected_if":["device-signed-video-only"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T06:17:09+00:00","first_seen_at":"2026-11-10T06:20:23+00:00","triaged_at":"2026-11-10T06:22:18+00:00","updated_at":"2026-11-10T06:22:18+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T06:22:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Signed Video Framework: out-of-bounds read can crash validation tools","impact":"low","summary":"The Signed Video Framework has an out-of-bounds read that can crash an application using it while it validates signed content. The sources say the issue affects only the tools that validate signed video, and that the AXIS OS device's signed video functionality is unaffected.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["signed-video-framework","axis-os"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"validating application crashes, causing denial of service","analyst_note":"","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["device-signed-video-only"],"who_is_affected":"Only applications that use the Signed Video Framework to validate signed video content are described as affected, and the sources say the device's own signed video functionality is unaffected. The sources do not name the specific validation tools or versions involved.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000655,"input_tokens":4544,"output_tokens":402,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-14918':15A,18A '-2026':14A,17A 'affect':55B,105C 'applic':42B,96C 'axi':20B,66B,116C 'axis-o':19B 'bound':7A,36B,84C 'contain':79C 'content':49B,114C 'could':93C 'crash':10A,40B,101C 'cve':13A,16A 'devic':68B,118C 'exclus':104C 'framework':3A,26B,30B,78C,91C,99C 'function':72B,122C 'infrastructur':22B 'issu':54B,86C,103C 'lead':94C 'os':21B,67B,117C 'out-of-bound':4A,33B,81C 'read':8A,37B,85C 'remain':123C 'say':52B 'sign':1A,24B,28B,48B,61B,70B,76C,89C,113C,120C 'signed-video-framework':23B 'sourc':51B 'tool':12A,58B,107C 'unaffect':74B,124C 'use':43B,97C,108C 'valid':11A,47B,60B,111C 'video':2A,25B,29B,62B,71B,77C,90C,121C","nicknames":[],"mitigations":[],"who_affected":"Only applications that use the Signed Video Framework to validate signed video content are described as affected, and the sources say the device's own signed video functionality is unaffected. The sources do not name the specific validation tools or versions involved.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["axisos","infrastructure","medium","signedvideoframework"],"campaign_type":null,"search_a":"'-14918':15A,18A '-2026':14A,17A 'bound':7A 'crash':10A 'cve':13A,16A 'framework':3A 'out-of-bound':4A 'read':8A 'sign':1A 'tool':12A 'valid':11A 'video':2A","search_b":"'affect':55B 'applic':42B 'axi':20B,66B 'axis-o':19B 'bound':36B 'content':49B 'crash':40B 'devic':68B 'framework':26B,30B 'function':72B 'infrastructur':22B 'issu':54B 'os':21B,67B 'out-of-bound':33B 'read':37B 'say':52B 'sign':24B,28B,48B,61B,70B 'signed-video-framework':23B 'sourc':51B 'tool':58B 'unaffect':74B 'use':43B 'valid':47B,60B 'video':25B,29B,62B,71B","search_c":"'affect':105C 'applic':96C 'axi':116C 'bound':84C 'contain':79C 'content':114C 'could':93C 'crash':101C 'devic':118C 'exclus':104C 'framework':78C,91C,99C 'function':122C 'issu':86C,103C 'lead':94C 'os':117C 'out-of-bound':81C 'read':85C 'remain':123C 'sign':76C,89C,113C,120C 'tool':107C 'unaffect':124C 'use':97C,108C 'valid':111C 'video':77C,90C,121C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T06:17:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","cvss_by":"product-security@axis.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-14918","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14918","severity":null,"published_at":"2026-11-10T06:17:09+00:00","modified_at":"2026-11-10T06:17:09+00:00","first_seen_at":"2026-11-10T06:20:23+00:00","fetched_at":"2026-11-10T06:20:23+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}