CVE-2026-58856

Analyzed Analyzed - Analysis Complete

Out-of-Bounds Read in Android Camera3 Stream Splitter

Publication date: 2026-10-05

Last updated on: 2026-10-07

Assigner: Android (associated with Google Inc. or Open Handset Alliance)

Description

In returnOutputBufferLocked of DeprecatedCamera3StreamSplitter.cpp, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-05

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-05

EPSS Evaluated

2026-10-18

NVD

CVE-2026-58856

EUVD

EUVD-2026-92616

Affected Vendors & Products

Vendor	Product	Version / Range
google	android	14.0
google	android	15.0
google	android	16.0
google	android	16.0
google	android	16.0
google	android	16.0
google	android	17.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-119	The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

Executive Summary

This vulnerability is an out-of-bounds read issue in the DeprecatedCamera3StreamSplitter.cpp file. It occurs because there is a missing bounds check in the returnOutputBufferLocked function. This flaw could allow an attacker to read memory outside the intended buffer, potentially exposing sensitive information.

Detection Guidance

This vulnerability is specific to Android's DeprecatedCamera3StreamSplitter.cpp and requires code-level analysis. Detection typically involves reviewing source code for missing bounds checks in the returnOutputBufferLocked function. No direct network or system commands can detect this issue.

Impact Analysis

This vulnerability could lead to local information disclosure. An attacker could exploit it to read sensitive data from memory without needing additional privileges or user interaction. This might include personal or confidential information stored in memory.

Compliance Impact

This vulnerability involves a possible out-of-bounds read in DeprecatedCamera3StreamSplitter.cpp, which could lead to local information disclosure. While it does not require user interaction or additional privileges, it may expose sensitive data locally. This could potentially impact compliance with GDPR or HIPAA if the disclosed information includes personal or health data, but the provided context does not specify the nature of the data involved.

Mitigation Strategies

Apply the latest Android security patches from Google. Disable affected camera services if patches are unavailable. Monitor Android security bulletins for updates related to this CVE.

Hi! I’m here to help you understand CVE-2026-58856. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70