{"id":"CVE-2026-95397","kind":"vulnerability","aliases":["CVE-2026-95397"],"related":[],"title":"Android HEVC decoder: buffer overflow lets a local app gain privileges","description":"In sub_layer_hrd_parameters of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.","summary":"A buffer overflow in the HEVC video decoder's sub-layer HRD parameter parsing can corrupt memory outside the heap. A local attacker who can already run code can use it to escalate privileges.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","hevc","media-codec","other"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:47+00:00","first_seen_at":"2026-11-10T20:46:16+00:00","triaged_at":"2026-11-10T20:49:27+00:00","updated_at":"2026-11-10T20:49:27+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T20:49:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android HEVC decoder: buffer overflow lets a local app gain privileges","impact":"high","summary":"A buffer overflow in the HEVC video decoder's sub-layer HRD parameter parsing can corrupt memory outside the heap. A local attacker who can already run code can use it to escalate privileges.","audience":"everyone","category":"other","nicknames":[],"who_cares":["android","hevc","media-codec"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"local code gains elevated privileges on the device","analyst_note":"Confirm the affected Android or vendor build and patch level from the NVD entry and the vendor security bulletin; no product ranges were supplied.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000639,"input_tokens":4544,"output_tokens":370,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-95397':14A,17A 'alreadi':49B 'android':1A,18B 'app':9A 'attack':46B 'buffer':4A,24B,73C,78C 'code':51B 'codec':22B 'corrupt':39B 'could':81C 'cve':12A,15A 'decod':3A,30B,65C 'due':75C 'escal':56B,85C 'execut':89C 'exploit':96C 'gain':10A 'heap':43B,72C 'hevc':2A,19B,28B,64C 'hrd':35B,61C 'interact':93C 'layer':34B,60C 'lead':82C 'let':6A 'local':8A,45B,84C 'media':21B 'media-codec':20B 'memori':40B 'need':91C 'non':71C 'non-heap':70C 'outsid':41B 'overflow':5A,25B,74C,79C 'paramet':36B,62C 'pars':37B 'possibl':69C 'privileg':11A,57B,87C,90C 'run':50B 'sub':33B,59C 'sub-lay':32B 'use':53B 'user':92C 'video':29B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","hevc","mediacodec","other","unknown"],"campaign_type":null,"search_a":"'-2026':13A,16A '-95397':14A,17A 'android':1A 'app':9A 'buffer':4A 'cve':12A,15A 'decod':3A 'gain':10A 'hevc':2A 'let':6A 'local':8A 'overflow':5A 'privileg':11A","search_b":"'alreadi':49B 'android':18B 'attack':46B 'buffer':24B 'code':51B 'codec':22B 'corrupt':39B 'decod':30B 'escal':56B 'heap':43B 'hevc':19B,28B 'hrd':35B 'layer':34B 'local':45B 'media':21B 'media-codec':20B 'memori':40B 'outsid':41B 'overflow':25B 'paramet':36B 'pars':37B 'privileg':57B 'run':50B 'sub':33B 'sub-lay':32B 'use':53B 'video':29B","search_c":"'buffer':73C,78C 'could':81C 'decod':65C 'due':75C 'escal':85C 'execut':89C 'exploit':96C 'heap':72C 'hevc':64C 'hrd':61C 'interact':93C 'layer':60C 'lead':82C 'local':84C 'need':91C 'non':71C 'non-heap':70C 'overflow':74C,79C 'paramet':62C 'possibl':69C 'privileg':87C,90C 'sub':59C 'user':92C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:47+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95397","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95397","severity":null,"published_at":"2026-11-10T20:19:47+00:00","modified_at":"2026-11-10T20:19:47+00:00","first_seen_at":"2026-11-10T20:46:16+00:00","fetched_at":"2026-11-10T20:46:16+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}