CVE-2026-58953: Buffer Overflow

Q: Which component should be included in exposure assessment?

The affected software is identified as Android's external/libopenapv component.

Q: Are affected versions, fixed versions, or mitigations specified?

No affected-version range, fixed version, or workaround is provided in the available data.

Published Nov 1, 2026

Updated

In decvlcread of oapvvlc.c, there is a possible out-of-bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Software

4 affected componentsFixes available

android/platform/external/libopenapv>=16:0<16:2026-11-01

16:2026-11-01

android/platform/external/libopenapv>=16-qpr2:0<16-qpr2:2026-11-01

16-qpr2:2026-11-01

android/platform/external/libopenapv>=17:0<17:2026-11-01

17:2026-11-01

Google Android

Event History

Nov 1, 2026

Advisory Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionAffected Software

Nov 2, 2026

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Data Sourced

via NVD·08:17 PM

Description

Frequently Asked Questions

Which component should be included in exposure assessment?

The affected software is identified as Android's external/libopenapv component.

Are affected versions, fixed versions, or mitigations specified?

No affected-version range, fixed version, or workaround is provided in the available data.

CVE-2026-58953: Buffer Overflow

Affected Software

Event History

Frequently Asked Questions

Which component should be included in exposure assessment?

Are affected versions, fixed versions, or mitigations specified?

Company

Resources

Contact

Frequently Asked Questions

Which component should be included in exposure assessment?

Are affected versions, fixed versions, or mitigations specified?