← WebKit Silent-Fix Report — 2026-W23
c195e933ce50176cc8364190abe293b5a859836c createVideoInfoFromAVCC() forms a span past the end of AVCC buffer for malformed input
severity medium
class OOB
confidence 0.55
WebCore Media/H264
Primitive: createVideoInfoFromAVCC() forms a span past the end of the AVCC buffer for malformed input
Triage note: In H264UtilitiesCocoa.mm the param-set subspan was built as avcc.subspan(reader.byteOffset()-1, *size) before validating the length with reader.skipBytes(); for malformed AVCC *size could extend past the buffer. The fix reorders skipBytes() before constructing the subspan, closing an OOB read over attacker-controlled media data.
Triage note: In H264UtilitiesCocoa.mm the param-set subspan was built as avcc.subspan(reader.byteOffset()-1, *size) before validating the length with reader.skipBytes(); for malformed AVCC *size could extend past the buffer. The fix reorders skipBytes() before constructing the subspan, closing an OOB read over attacker-controlled media data.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…