security
CVE-2026-59618: Out-of-bounds read in the Google Pixel's JPEG encoder
- severity
- Moderate
- component
- Out-of-bounds read in Pixel JPEG (SMFC)
- reported
- Android VRP,
- status
- fix in progress
- write-up
- generic pass
Android Security Bulletins ↗ Android & Google Devices VRP ↗
In April 2026 I reported a bug in the Pixel’s hardware JPEG encoder to Android’s VRP. Google assigned it CVE-2026-59618 and rated it a Moderate severity vulnerability.
The encoder is a small piece of hardware called SMFC and it has a single job: take a camera frame and turn it into a JPEG, quickly.
I found a way to get it to read outside the frame I handed it.
Timeline#
- 2026-04-27: reported to the Android VRP
- 2026-06-22: rated Moderate
- 2026-10-13: CVE-2026-59618 assigned
- (fix / public bulletin: pending)