Live › vulnerability › CVE-2026-58949
A stack buffer overflow in the Android media metadata parser (StagefrightMetadataRetriever) can crash the process that parses a crafted media file. The sources describe a remote denial of service that needs no extra privileges and no user interaction.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 20:35 UTC. All times on this page are UTC.
Android devices whose media framework parses the affected metadata. Sources do not name affected Android versions or patch levels. Servers and desktops that do not run the Android media stack are not affected.
No product ranges from the sources yet.
Unknown from the sources.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In parseMetaData of StagefrightMetadataRetriever.cpp, there is a possible denial of service due to a stack buffer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
This page as .md · .json · in your agent: get_signal("CVE-2026-58949")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.