Executive brief
Android devices include a video decoder component that processes HEVC-encoded video files. A heap buffer overflow in this decoder can be exploited by a local attacker without requiring special permissions or user interaction, allowing them to escalate privileges and gain unauthorized access to system functions.
Technical details
A heap buffer overflow exists in the ihevcd_get_tu_data_size function within ihevcd_utils.c of the Android HEVC video decoder. The vulnerability results from improper bounds checking when writing to heap memory during TU (Transform Unit) data processing. Exploitation requires local code execution capability but no special privileges; user interaction is not required. A malicious local application or process can trigger the overflow to write beyond allocated heap boundaries, potentially corrupting adjacent memory structures and achieving local privilege escalation. Patches are available for Android 14 through 17; security patch level 2026-09-05 or later addresses this issue.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched