{"id":"CVE-2026-59612","kind":"vulnerability","aliases":["CVE-2026-59612"],"related":[],"title":"avc_decoder buffering_period: buffer overflow lets local code escalate privileges","description":"In buffering_period of avc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.","summary":"A buffer overflow in the buffering_period function of avc_decoder can be triggered to write outside its buffer. The description says this can lead to local privilege escalation, with user interaction needed for exploitation.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"avc_decoder","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["avc-decoder","h264","infrastructure"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:31+00:00","first_seen_at":"2026-11-10T20:46:14+00:00","triaged_at":"2026-11-10T20:49:50+00:00","updated_at":"2026-11-10T20:49:50+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T20:49:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"avc_decoder buffering_period: buffer overflow lets local code escalate privileges","impact":"high","summary":"A buffer overflow in the buffering_period function of avc_decoder can be triggered to write outside its buffer. The description says this can lead to local privilege escalation, with user interaction needed for exploitation.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["avc-decoder","h264"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"local code gains elevated privileges on the machine","analyst_note":"Identify the vendor and affected versions of avc_decoder from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-59612) and find the fixed release.","how_to_check":"unknown","plain_action":"","product_name":"avc_decoder","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources do not name the affected product versions or the exact deployment path. The description points to local execution of code that processes AVC (H.264) video data. unknown","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000676,"input_tokens":4526,"output_tokens":446,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-59612':14A,17A 'avc':1A,18A,21B,34B,64C 'avc-decod':20B 'buffer':3A,5A,26B,30B,43B,61C,73C,78C 'code':9A 'could':81C 'cve':12A,15A 'decod':2A,22B,35B,65C 'decoder':19A 'descript':45B 'due':75C 'escal':10A,53B,85C 'execut':89C 'exploit':59B,96C 'function':32B 'h264':23B 'heap':72C 'infrastructur':24B 'interact':56B,93C 'lead':49B,82C 'let':7A 'local':8A,51B,84C 'need':57B,91C 'non':71C 'non-heap':70C 'outsid':41B 'overflow':6A,27B,74C,79C 'period':4A,31B,62C 'possibl':69C 'privileg':11A,52B,87C,90C 'say':46B 'trigger':38B 'user':55B,92C 'write':40B","nicknames":[],"mitigations":[],"who_affected":"The sources do not name the affected product versions or the exact deployment path. The description points to local execution of code that processes AVC (H.264) video data. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["avcdecoder"],"ptokens":["avc","decoder"],"labels":["avcdecoder","h264","infrastructure","unknown","vendor"],"campaign_type":null,"search_a":"'-2026':13A,16A '-59612':14A,17A 'avc':1A,18A 'buffer':3A,5A 'code':9A 'cve':12A,15A 'decod':2A 'decoder':19A 'escal':10A 'let':7A 'local':8A 'overflow':6A 'period':4A 'privileg':11A","search_b":"'avc':21B,34B 'avc-decod':20B 'buffer':26B,30B,43B 'decod':22B,35B 'descript':45B 'escal':53B 'exploit':59B 'function':32B 'h264':23B 'infrastructur':24B 'interact':56B 'lead':49B 'local':51B 'need':57B 'outsid':41B 'overflow':27B 'period':31B 'privileg':52B 'say':46B 'trigger':38B 'user':55B 'write':40B","search_c":"'avc':64C 'buffer':61C,73C,78C 'could':81C 'decod':65C 'due':75C 'escal':85C 'execut':89C 'exploit':96C 'heap':72C 'interact':93C 'lead':82C 'local':84C 'need':91C 'non':71C 'non-heap':70C 'overflow':74C,79C 'period':62C 'possibl':69C 'privileg':87C,90C 'user':92C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59612","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59612","severity":null,"published_at":"2026-11-10T20:19:31+00:00","modified_at":"2026-11-10T20:19:31+00:00","first_seen_at":"2026-11-10T20:46:14+00:00","fetched_at":"2026-11-10T20:46:14+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}