https://seclists.org/oss-sec/2026/q3/702: Memory-safety defects in the upstam (abandoned) AOSP OpenCOAAC decoder, shipped unpatched by Samsung TizenRT
Published Sep 10, 2026
·Updated
Affected Software
3 affected components
Samsung TizenRT
AOSP platform_external_opencore (external/opencore codecs_v2/audio/aac/dec)
bouffalolab/bouffalo_sdk (aacdec_v1.2.0)=aacdec_v1.2.0
Frequently Asked Questions
1
Which findings were confirmed through runtime testing, and which were identified by source review?
A wild-pointer segmentation fault in get_tns and an out-of-bounds read in trans4m_freq_2_time_fxp were reproduced under AddressSanitizer. The out-of-bounds write in get_dse was confirmed through code review; it is an intra-union write that AddressSanitizer cannot observe.
2
Which source locations should maintainers inspect when determining exposure?
In TizenRT, inspect external/audiocodec/aacdec/get_dse.c, including the reported issue at line 223. The corresponding AOSP source is codecs_v2/audio/aac/dec/src/get_dse.cpp, with the reported location at line 205.
3
Is the issue limited to Samsung TizenRT?
No. The affected decoder is the abandoned AOSP OpenCORE AAC decoder and is described as being vendored and built by multiple projects. The listed software includes Samsung TizenRT, AOSP platform_external_opencore, and bouffalolab/bouffalo_sdk with aacdec_v1.2.0.