Vulnerability in Google Android

[ Description ]Official description

In returnOutputBufferLocked of DeprecatedCamera3StreamSplitter.cpp, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

[ Fixes ]Fixes and patches

• Patch on source.android.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ Advisories ]Government CERT advisories

• NCSC-NL7 Oct 2026NCSC-2026-0405

  Vulnerabilities fixed in Google Android Translated from Dutch

  Probability/damage M/HCVE-2026-21114CVE-2026-21115CVE-2026-21116+35 more CVEs
• CERT-FR6 Oct 2026CERTFR-2026-AVI-1265

  Multiple vulnerabilities in Google Android Translated from French

  Multiple vulnerabilities have been discovered in Google Android. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and a breach of data confidentiality.

  CVE-2026-55265CVE-2026-55279CVE-2026-55286+22 more CVEs
• BSI CERT-Bund5 Oct 2026WID-SEC-2026-3740

  Android Patchday Oktober 2026: Multiple vulnerabilities Translated from German

  CVE-2026-58835CVE-2026-55280CVE-2026-45524+22 more CVEs

[ References ]References

• source.android.com/docs/security/bulletin/2026/2026-10-01PatchVendor Advisory