Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Android media framework can leak data

CVE-2021-0311 · published 5 years ago
Summary

A part of Android's media processing code can write past the end of a memory buffer, which may let a remote attacker read internal information. Exploitation requires the user to open a specially crafted video file, but no additional privileges are needed. Apply the latest Android security updates or patches that fix the buffer check.

What to do
  • Update google platform/frameworks/av to version 8.0:2021-01-01.
  • Update google platform/frameworks/av to version 8.1:2021-01-01.
  • Update google platform/frameworks/av to version 9:2021-01-01.
  • Update google platform/frameworks/av to version 10:2021-01-01.
  • Update google platform/frameworks/av to version 11:2021-01-01.
Affected software
Ecosystem VendorProductAffected versions
Android google platform/frameworks/av >= 8.0:0, < 8.0:2021-01-01
>= 8.1:0, < 8.1:2021-01-01
>= 9:0, < 9:2021-01-01
>= 10:0, < 10:2021-01-01
>= 11:0, < 11:2021-01-01
Fix: upgrade to 8.0:2021-01-01
– google android 8.0
8.1
9.0
10.0
11.0
cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*
Original advisory text
In ElementaryStreamQueue::dequeueAccessUnitH264() of ESQueue.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote information disclosure with no add...
In ElementaryStreamQueue::dequeueAccessUnitH264() of ESQueue.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
References
Severity
6.5 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-787Out-of-bounds Write
Timeline
Published1 Jan 2021
Updated4 Nov 2026
First seen10 Sep 2026
Sources
ASB-A-170240631 · OSV
CVE-2021-0311 · NVD
Track software like this
Free during beta