streambox-cve-2026-28618

Zero-click APV, in a player that auto-plays shared clips CVE-2026-28618 in StreamBox — the same OpenAPV decoder class as CVE-2026-0006, turned into a heap write against a session object. This repo is a public, redacted writeup: flags, instance tokens, and the HMAC key are omitted. The APK and...

Exploit for Heap-based Buffer Overflow in Google Android

Zero-click APV, in a player that auto-plays shared clips CV...

Malicious code in streambox-client (npm)

The package streambox-client was found to contain malicious code...

MAL-2025-34084 Malicious code in streambox-client (npm)

The package streambox-client was found to contain malicious code...