CVE-2026-57047

CriticalCVSS 9.8/10Last modified Nov 13, 2026

Description

In __mfc_core_nal_q_get_dec_metadata_sei_nal of mfc_core_nal_q.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119CWE-787

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
GoogleAndroidAndroid kernel

References

Timeline

Published
Nov 10, 2026
Last modified
Nov 13, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-570486.7In authenticate of verify_image, there is a possible Signature verification logic bypass due to a logic error in the code. This could lead tCVE-2026-57054.3A vulnerability was identified in code-projects Online Hotel Booking 1.0. Affected by this vulnerability is an unknown functionality of the CVE-2026-570532.5GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicoCVE-2026-570545.8A Use of Incorrectly-Resolved Name or Reference vulnerability in the URL filtering plugin of Juniper Networks Junos OS on MX Series allows aCVE-2026-57068.9In Bluetooth Mesh SDK 6.1.4 and earlier, malformed extended advertisements can trigger out-of-bounds writes leading to stack corruption and CVE-2026-570622.9CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is suppCVE-2026-57078.8Unsanitized input in an OS command in the virtual desktop session name handling in AWS Research and Engineering Studio (RES) version 2025.03CVE-2026-570739.1HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead. The parserc_parse function attempts to check for multicharCVE-2026-570749.1XML::Bare versions through 0.53 for Perl have an unbounded character lookahead. The parserc_parse function attempts to check for multicharaCVE-2026-570759.1YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syck_base64dec. The base64 decCVE-2026-570767.8YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in syck_hdlr_add_anchCVE-2026-570777.7YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len. In the bundled libsyck n