CVE-2026-0006 AI-generated analysis

platform/external/libopenapv (OpenAPV codec library). Per index search, it is used by the Codec2 software APV components in frameworks/av/media/codec2/components/apv.

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (10 corrections). Verify against the commit before relying on it.

The fix upgrades external/libopenapv as a whole, from upstream v0.1.13.1 to v0.2.0.0 (commit cf0a0e7a810e, bug 423894847). This replaces the APV bitstream/VLC code (src/oapv_vlc.c), the metadata handling (src/oapv_metadata.c), the bitstream reader/writer (src/oapv_bs.c) and the core codec (src/oapv.c) with newer upstream code, and changes the public API in inc/oapv.h.

Root cause

The material does not isolate the vulnerable code. The fix commit is a version bump ('Upgrade libopenapv to v0.2.0.0') that touches 47 files, with 2651 insertions and 2383 deletions. The diff provided covers the build files, the sample apps, inc/oapv.h, the AVX/NEON transform code and the start of src/oapv.c. The diffs for src/oapv_vlc.c (1458 lines changed), src/oapv_metadata.c (367) and src/oapv_bs.c (28) are in the truncated part. The bulletin only gives the severity (Critical) and type (RCE). Visible changes: the oapvm_payload metadata structure is reordered (data_size renamed to size and moved before data, uuid moved to the end); oapvm_set loses its uuid parameter; new error codes are added (OAPV_ERR_INVALID_PROFILE, OAPV_ERR_INVALID_WIDTH, OAPV_ERR_INVALID_HEIGHT, OAPV_ERR_INVALID_QP, OAPV_ERR_INVALID_FAMILY). The specific missing check in v0.1.13.1 cannot be identified from the provided diff.

How the fix works

• The fix is not a targeted patch. It imports upstream openapv v0.2.0.0 through external_updater (METADATA: version v0.1.13.1 -> v0.2.0.0, last_upgrade_date 2025-07-28).
• inc/oapv.h, public API/ABI changes: - oapvm_payload field layout changed (size before data, uuid last). - oapvm_set(mid, group_id, type, data, size) loses the uuid argument. - oapv_version() becomes oapv_version(unsigned int *ver_num). - New error codes OAPV_ERR_INVALID_PROFILE/WIDTH/HEIGHT/QP/FAMILY. - New profile constants (422-12, 444-10, 444-12, 4444-10, 4444-12, 400-10). - OAPV_CS_YCBCR400_14LE and OAPV_CS_YCBCR420_14LE removed; 12-bit 422/444/4444 color-space constants added. - oapve_param.csp and OAPV_CDESC_THREADS_AUTO removed. - OAPV_CFG_SET_AU_BS_FMT/OAPV_CFG_GET_AU_BS_FMT and oapve_family_bitrate() added. - OAPV_EXPORT is empty when ANDROID is defined.
• src/oapv.c: the pixel-conversion helpers now take a bit-depth parameter instead of being fixed at 10 bits (imgb_to_blk, imgb_to_blk_16, imgb_to_blk_p21x_*, blk_to_imgb_16, blk_to_imgb_p21x_*). imgb_pad and imgb_pad_p210 are new, and plus_mid_val is removed. The diff for the decoder functions (dec_frm_prepare, dec_tile_comp, dec_tile, oapvd_decode, oapvd_info) is in the truncated portion.
• src/oapv_vlc.c, src/oapv_metadata.c, src/oapv_bs.c: the bitstream and metadata parsers are replaced by the v0.2.0.0 versions, and their diffs are not in the material. In the context shown at android-security-16.0.0_r8, oapv_bsw_sink asserts bs->cur + BSW_GET_SINK_BYTE(bs) < bs->end and oapvd_vlc_metadata takes pbu_size. The material does not show whether either is new.
• src/avx/oapv_tq_avx.c, src/neon/oapv_tq_neon.c, src/oapv_tq.c: on the encoder side, the forward transform signature changes to oapv_fn_tx_t(src, shift1, shift2, line), with a two-stage transform written back into src (oapv_tx_avx, oapv_tx_pb8b_neon, oapv_tx). The AVX inverse transform and dequantization code (decoder side) is moved into macros (ITX_PROCESSING_ODD/EVEN, ITX_POSTPROCESSING, DQUANT_POSTPROCESSING). The visible hunks reorganize existing code and are not evidently security related.

Completeness

• Because the fix is a full library upgrade, it covers every change between upstream v0.1.13.1 and v0.2.0.0, not only the vulnerable path. The hunk that fixes the defect cannot be identified from the provided (truncated) diff.
• The upgrade changes the public API/ABI (oapvm_set signature, oapvm_payload layout, oapv_version signature, removed oapve_param.csp). The commit message says 'All commits must go together' and lists two Cherrypick-From changes. The content of the other change is not in the material.
• Per index search, frameworks/av/media/codec2/components/apv (C2SoftApvDec.cpp, C2SoftApvEnc.h) uses this library. The material does not show whether those callers were updated in the same security tag.

Behavior changes

• Callers can receive new library error codes: OAPV_ERR_INVALID_PROFILE (-400), OAPV_ERR_INVALID_WIDTH (-405), OAPV_ERR_INVALID_HEIGHT (-406), OAPV_ERR_INVALID_QP (-410), OAPV_ERR_INVALID_FAMILY (-501).
• New profile constants and 12-bit color-space constants are defined (422-12, 444-10/12, 4444-10/12, 400-10). The 14-bit 400/420 color-space constants are removed.
• oapvm_set no longer takes a uuid parameter. The new oapvm_payload field order and the data_size -> size rename break source and binary compatibility for code that uses metadata.
• The oapv_version() signature changes to oapv_version(unsigned int *ver_num). The CMake build now takes the version from the OAPV_VER_* macros in inc/oapv.h instead of git tags or version.txt.
• oapve_param.csp is removed. OAPV_CFG_SET_AU_BS_FMT is added to select raw_bitstream_access_unit framing.

Per major

• Android 14: not affected: not listed by the bulletin; external/libopenapv is not present in android-security-14.0.0_r29.
• Android 15: not affected: not listed by the bulletin; external/libopenapv is not present in android-security-15.0.0_r17.
• Android 16: same fix: the upstream upgrade to v0.2.0.0 landed as cf0a0e7a810e in android-security-16.0.0_r4. At android-security-16.0.0_r8 the files shown (METADATA v0.2.0.0, inc/oapv.h OAPV_VER_MAJOR 2) match the upgraded state; the resolver reports 2/8 lines of the patched region present.
• Android 17: not affected: not listed by the bulletin. At android-security-17.0.0_r1 the resolver finds 2/8 lines of the patched region; the library version there is not shown.

Unknowns

• The specific vulnerable function and missing check in v0.1.13.1. The diffs for src/oapv_vlc.c, src/oapv_metadata.c, src/oapv_bs.c and the decoder half of src/oapv.c are truncated in the material.
• The trigger (which PBU, metadata or frame-header construct) and the memory-safety class of the defect.
• What the second Cherrypick-From change (45025ca521e7) contains, and whether frameworks/av callers needed changes.
• Whether the new profiles and 12-bit formats are accepted by the decoder, or only defined in the header.
• Which library version Android 17's tree carries.

Back to March 2026 · Findings