{"id":"CVE-2026-58933","kind":"vulnerability","aliases":["CVE-2026-58933"],"related":[],"title":"C2SoftApvDec decoder: out-of-bounds read leaks remote information","description":"In process of C2SoftApvDec.cpp, there is a possible out-of-bounds read due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"The C2SoftApvDec.cpp component has a logic error that allows an out-of-bounds memory read. A remote attacker can use it to disclose information from memory without any user interaction.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","c2softapvdec","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T20:17:50+00:00","first_seen_at":"2026-11-02T20:35:32+00:00","triaged_at":"2026-11-02T20:38:47+00:00","updated_at":"2026-11-02T20:38:47+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-11-02T20:38:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"C2SoftApvDec decoder: out-of-bounds read leaks remote information","impact":"low","summary":"The C2SoftApvDec.cpp component has a logic error that allows an out-of-bounds memory read. A remote attacker can use it to disclose information from memory without any user interaction.","audience":"everyone","category":"package","nicknames":[],"who_cares":["c2softapvdec","android"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"remote attacker reads memory contents and leaks information","analyst_note":"Identify the affected product and versions for C2SoftApvDec.cpp (likely an Android media codec component) and check the NVD entry for version ranges and fixes.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000589,"input_tokens":4097,"output_tokens":358,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-58933':13A,16A 'addit':81C 'allow':28B 'android':17B 'attack':38B 'bound':6A,33B,62C 'c2softapvdec':1A,18B 'c2softapvdec.cpp':21B,54C 'code':71C 'compon':22B 'could':73C 'cve':11A,14A 'decod':2A 'disclos':43B 'disclosur':78C 'due':64C 'error':26B,68C 'execut':82C 'exploit':91C 'inform':10A,44B,77C 'interact':50B,86C 'lead':74C 'leak':8A 'logic':25B,67C 'memori':34B,46B 'need':84C,89C 'out-of-bound':3A,30B,59C 'packag':19B 'possibl':58C 'privileg':83C 'process':52C 'read':7A,35B,63C 'remot':9A,37B,76C 'use':40B 'user':49B,85C 'without':47B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","c2softapvdec","package","unknown"],"first_public_at":"2026-11-02T20:17:50+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58933","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58933","severity":null,"published_at":"2026-11-02T20:17:50+00:00","modified_at":"2026-11-02T20:17:50+00:00","first_seen_at":"2026-11-02T20:35:32+00:00","fetched_at":"2026-11-02T20:35:32+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}