CVE-2026-58710
published 2026-09-15CVE-2026-58710: In DecodeFilmGrainParams of film_grain_dec.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution…
PriorityP262high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.37%
30.0th percentile
In DecodeFilmGrainParams of film_grain_dec.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| android | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Google Android Film Grain Decoding film_grain_dec.cc DecodeFilmGrainParams out-of-bounds write (CNNVD-2026-99990992)
vuldb·2026-09-20·CVSS 8.8
CVE-2026-58710 [HIGH] Google Android Film Grain Decoding film_grain_dec.cc DecodeFilmGrainParams out-of-bounds write (CNNVD-2026-99990992)
A vulnerability categorized as very critical has been discovered in Google Android. Affected by this issue is the function DecodeFilmGrainParams of the file film_grain_dec.cc of the component Film Grain Decoding. Executing a manipulation can lead to out-of-bounds write.
This vulnerability is tracked as CVE-2026-58710. The attack can be launched remotely. No exploit exists.
A patch should be applied to remediate this issue.
GHSA
In DecodeFilmGrainParams of film_grain_dec.cc, there is a possible out-of-bounds write due to a missing bounds check.
ghsa_unreviewed·2026-09-15
CVE-2026-58710 [HIGH] CWE-120 In DecodeFilmGrainParams of film_grain_dec.cc, there is a possible out-of-bounds write due to a missing bounds check.
In DecodeFilmGrainParams of film_grain_dec.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-15
Published