{"id":"CVE-2026-58938","kind":"vulnerability","aliases":["CVE-2026-58938"],"related":[],"title":"Android MPEG4 parser: crafted media file can cause denial of service","description":"In parseChunk of MPEG4Extractor.cpp, there is a possible denial of service due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"A flaw in the MPEG-4 parsing code (parseChunk in MPEG4Extractor.cpp) lets a malformed media file crash or stall the parser. An attacker gets remote denial of service, with no extra privileges and no user interaction needed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","media-parsing","runtime"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T20:17:51+00:00","first_seen_at":"2026-11-02T20:35:33+00:00","triaged_at":"2026-11-02T20:38:44+00:00","updated_at":"2026-11-02T20:38:44+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-11-02T20:38:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Android MPEG4 parser: crafted media file can cause denial of service","impact":"low","summary":"A flaw in the MPEG-4 parsing code (parseChunk in MPEG4Extractor.cpp) lets a malformed media file crash or stall the parser. An attacker gets remote denial of service, with no extra privileges and no user interaction needed.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["android","media-parsing"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote denial of service: the media parser crashes or hangs.","analyst_note":"Identify the affected Android or AOSP versions and whether a patch or Android security bulletin entry exists; the NVD entry alone does not name them.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"The sources say only that remote denial of service is possible through improper input validation in the MPEG-4 extractor, with no extra privileges and no user interaction. They do not name affected products or versions, so the exposed systems are unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000634,"input_tokens":4092,"output_tokens":449,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-4':28B '-58938':14A,17A 'addit':86C 'android':1A,18B 'attack':45B 'caus':8A 'code':30B 'could':77C 'craft':4A 'crash':39B 'cve':12A,15A 'denial':9A,48B,68C,81C 'due':71C 'execut':87C 'exploit':96C 'extra':53B 'file':6A,38B 'flaw':24B 'get':46B 'improp':73C 'input':74C 'interact':58B,91C 'lead':78C 'let':34B 'malform':36B 'media':5A,20B,37B 'media-pars':19B 'mpeg':27B 'mpeg4':2A 'mpeg4extractor.cpp':33B,63C 'need':59B,89C,94C 'pars':21B,29B 'parsechunk':31B,61C 'parser':3A,43B 'possibl':67C 'privileg':54B,88C 'remot':47B,80C 'runtim':22B 'servic':11A,50B,70C,83C 'stall':41B 'user':57B,90C 'valid':75C","nicknames":[],"mitigations":[],"who_affected":"The sources say only that remote denial of service is possible through improper input validation in the MPEG-4 extractor, with no extra privileges and no user interaction. They do not name affected products or versions, so the exposed systems are unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","mediaparsing","runtime","unknown"],"first_public_at":"2026-11-02T20:17:51+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58938","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58938","severity":null,"published_at":"2026-11-02T20:17:51+00:00","modified_at":"2026-11-02T20:17:51+00:00","first_seen_at":"2026-11-02T20:35:33+00:00","fetched_at":"2026-11-02T20:35:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}