CVE-2026-14918
Received Received - Intake

Signed Video Framework Out-of-Bounds Read Vulnerability

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: Axis Communications AB

Description
The Signed Video Framework contained a out-of-bounds read issue in the Signed Video Framework which could lead the application using this framework to crash. The issue exclusively affects the tools used for the validation of signed content. The AXIS OS device's signed video functionality remains unaffected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-14918
EUVD
EUVD-2026-120774

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Axis Communications AB Signed Video Framework From 0 (inc) to 2.3.7 (exc)
Axis Communications AB Signed media verifier From 0 (inc) to 1.0.3 (exc)
Axis Communications AB Axis File Player From 0 (inc) to 3.1.10.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an out-of-bounds read vulnerability in the Signed Video Framework. It affects versions 2.3.6 and earlier, the Signed media verifier (1.0.2 and earlier), and Axis File Player (3.1.9.0 and earlier). The flaw could cause applications using the framework to crash but only impacts tools for validating signed content. AXIS OS devices' signed video functionality remains unaffected.

Detection Guidance

The vulnerability affects specific versions of the Signed Video Framework, Signed media verifier, and Axis File Player. Detection involves checking installed versions of these tools against the affected versions (Signed Video Framework <=2.3.6, Signed media verifier <=1.0.2, Axis File Player <=3.1.9.0). Use package managers or version commands like 'signed-video-framework --version' to verify.

Impact Analysis

The vulnerability could cause applications using the Signed Video Framework to crash. Since it only affects tools for validating signed content, the impact is limited to those specific applications. No public exploits are currently known.

Compliance Impact

The vulnerability does not directly affect compliance with GDPR or HIPAA as it only causes applications to crash without impacting data integrity or confidentiality. However, if an application crash disrupts services handling sensitive data, it could indirectly impact compliance by causing downtime or data processing delays.

Mitigation Strategies

Immediately update to the patched versions: Signed Video Framework 2.3.7, Signed media verifier 1.0.3, or Axis File Player 3.1.10.0. If updates are unavailable, discontinue use of the affected tools until patched versions are installed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14918. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...