In isValid of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"fixes": [
"https://android.googlesource.com/platform/hardware/interfaces/+/54ed71c54672af6e1806d5cbc58ab8e38137c4ba"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"ID"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"line_hashes": [
"40592511717342990389942058539945609306",
"1215199241451092441693081628498869121",
"129948529691575016124142609218851295746",
"180984362077311833556099534600156618805",
"196474455315920770780076363565407616005",
"7710838437947647161968512562153547620",
"289101019889694858839139463180580597518"
],
"threshold": 0.9
},
"id": "ASB-A-269456968-8ee0ac38",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/interfaces/+/54ed71c54672af6e1806d5cbc58ab8e38137c4ba",
"target": {
"file": "neuralnetworks/aidl/vts/functional/ValidateModel.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "255834689267382053440549860468519338361",
"length": 840
},
"id": "ASB-A-269456968-baa82bfd",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/interfaces/+/54ed71c54672af6e1806d5cbc58ab8e38137c4ba",
"target": {
"file": "neuralnetworks/aidl/vts/functional/ValidateModel.cpp",
"function": "validateModel"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/3aedb5493147609aca83519618e7cf0bf33c2123"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"ID"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "117549551585405145896197857986194020165",
"length": 2040
},
"id": "ASB-A-269456968-56a726db",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/3aedb5493147609aca83519618e7cf0bf33c2123",
"target": {
"file": "shim_and_sl/ShimConverter.cpp",
"function": "isValid"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"75187719208275870646090957093481890954",
"340131414929134843437663854480429539680",
"54001838752359329900919718142955712081",
"285250356260115474433082804678168617461",
"109424735767730076176734673742369407379",
"39573811633329355338794009495144039177",
"182830228131374686493677244538863397532",
"98379926951023035715857893892377015667",
"188637344271475611293398993770431629553",
"229387678612352843714756599500284039861",
"85359450305213975842027923137755667731",
"220001508687791037264125116951112954330",
"324735370805818494230502263013918886225",
"101085154751499475628652996322645265504",
"67375320668609752978282465410270834414",
"120552197073837783068915436307065730213",
"126287348359886453068673444172571704445",
"50757414922992344976773212318036965487"
],
"threshold": 0.9
},
"id": "ASB-A-269456968-61aabd5f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/3aedb5493147609aca83519618e7cf0bf33c2123",
"target": {
"file": "shim_and_sl/ShimConverter.cpp"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/hardware/interfaces/+/f175a9842907a57cf98f238dbd64022dcb1acd4f"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"ID"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "255834689267382053440549860468519338361",
"length": 840
},
"id": "ASB-A-269456968-13286ff3",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/interfaces/+/f175a9842907a57cf98f238dbd64022dcb1acd4f",
"target": {
"file": "neuralnetworks/aidl/vts/functional/ValidateModel.cpp",
"function": "validateModel"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"40592511717342990389942058539945609306",
"1215199241451092441693081628498869121",
"129948529691575016124142609218851295746",
"180984362077311833556099534600156618805",
"196474455315920770780076363565407616005",
"7710838437947647161968512562153547620",
"289101019889694858839139463180580597518"
],
"threshold": 0.9
},
"id": "ASB-A-269456968-48621dd5",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/interfaces/+/f175a9842907a57cf98f238dbd64022dcb1acd4f",
"target": {
"file": "neuralnetworks/aidl/vts/functional/ValidateModel.cpp"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/b6fa7d7c01b682ca744a23762ce846427ad1135b"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"ID"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "117549551585405145896197857986194020165",
"length": 2040
},
"id": "ASB-A-269456968-b2779a72",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/b6fa7d7c01b682ca744a23762ce846427ad1135b",
"target": {
"file": "shim_and_sl/ShimConverter.cpp",
"function": "isValid"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"75187719208275870646090957093481890954",
"340131414929134843437663854480429539680",
"54001838752359329900919718142955712081",
"285250356260115474433082804678168617461",
"109424735767730076176734673742369407379",
"39573811633329355338794009495144039177",
"182830228131374686493677244538863397532",
"98379926951023035715857893892377015667",
"188637344271475611293398993770431629553",
"229387678612352843714756599500284039861",
"85359450305213975842027923137755667731",
"220001508687791037264125116951112954330",
"324735370805818494230502263013918886225",
"101085154751499475628652996322645265504",
"67375320668609752978282465410270834414",
"120552197073837783068915436307065730213",
"126287348359886453068673444172571704445",
"50757414922992344976773212318036965487"
],
"threshold": 0.9
},
"id": "ASB-A-269456968-b74e00fa",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/b6fa7d7c01b682ca744a23762ce846427ad1135b",
"target": {
"file": "shim_and_sl/ShimConverter.cpp"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/hardware/interfaces/+/780a671da3d030368345155adc97e1687f8658de"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"ID"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "255834689267382053440549860468519338361",
"length": 840
},
"id": "ASB-A-269456968-117fc0ca",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/interfaces/+/780a671da3d030368345155adc97e1687f8658de",
"target": {
"file": "neuralnetworks/aidl/vts/functional/ValidateModel.cpp",
"function": "validateModel"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"40592511717342990389942058539945609306",
"1215199241451092441693081628498869121",
"129948529691575016124142609218851295746",
"180984362077311833556099534600156618805",
"196474455315920770780076363565407616005",
"7710838437947647161968512562153547620",
"289101019889694858839139463180580597518"
],
"threshold": 0.9
},
"id": "ASB-A-269456968-b75687c4",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/interfaces/+/780a671da3d030368345155adc97e1687f8658de",
"target": {
"file": "neuralnetworks/aidl/vts/functional/ValidateModel.cpp"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/2cd68475b487672290c44e7adaed5a8f76ef1957"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"ID"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"line_hashes": [
"75187719208275870646090957093481890954",
"340131414929134843437663854480429539680",
"54001838752359329900919718142955712081",
"285250356260115474433082804678168617461",
"109424735767730076176734673742369407379",
"39573811633329355338794009495144039177",
"182830228131374686493677244538863397532",
"98379926951023035715857893892377015667",
"188637344271475611293398993770431629553",
"229387678612352843714756599500284039861",
"85359450305213975842027923137755667731",
"220001508687791037264125116951112954330",
"324735370805818494230502263013918886225",
"101085154751499475628652996322645265504",
"67375320668609752978282465410270834414",
"120552197073837783068915436307065730213",
"126287348359886453068673444172571704445",
"50757414922992344976773212318036965487"
],
"threshold": 0.9
},
"id": "ASB-A-269456968-00e7ab1e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/2cd68475b487672290c44e7adaed5a8f76ef1957",
"target": {
"file": "shim_and_sl/ShimConverter.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "117549551585405145896197857986194020165",
"length": 2040
},
"id": "ASB-A-269456968-6540ee1d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/2cd68475b487672290c44e7adaed5a8f76ef1957",
"target": {
"file": "shim_and_sl/ShimConverter.cpp",
"function": "isValid"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/hardware/interfaces/+/332a204885a17a96969b6cfba494f2463db574e0"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"ID"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"line_hashes": [
"40592511717342990389942058539945609306",
"1215199241451092441693081628498869121",
"129948529691575016124142609218851295746",
"180984362077311833556099534600156618805",
"196474455315920770780076363565407616005",
"7710838437947647161968512562153547620",
"289101019889694858839139463180580597518"
],
"threshold": 0.9
},
"id": "ASB-A-269456968-78c5da37",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/interfaces/+/332a204885a17a96969b6cfba494f2463db574e0",
"target": {
"file": "neuralnetworks/aidl/vts/functional/ValidateModel.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "255834689267382053440549860468519338361",
"length": 840
},
"id": "ASB-A-269456968-b86a92c0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/interfaces/+/332a204885a17a96969b6cfba494f2463db574e0",
"target": {
"file": "neuralnetworks/aidl/vts/functional/ValidateModel.cpp",
"function": "validateModel"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/75e56c8ef4c213ccf72b12fbe076d125c5192865"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"ID"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "117549551585405145896197857986194020165",
"length": 2040
},
"id": "ASB-A-269456968-4b252925",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/75e56c8ef4c213ccf72b12fbe076d125c5192865",
"target": {
"file": "shim_and_sl/ShimConverter.cpp",
"function": "isValid"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"75187719208275870646090957093481890954",
"340131414929134843437663854480429539680",
"54001838752359329900919718142955712081",
"285250356260115474433082804678168617461",
"109424735767730076176734673742369407379",
"39573811633329355338794009495144039177",
"182830228131374686493677244538863397532",
"98379926951023035715857893892377015667",
"188637344271475611293398993770431629553",
"229387678612352843714756599500284039861",
"85359450305213975842027923137755667731",
"220001508687791037264125116951112954330",
"324735370805818494230502263013918886225",
"101085154751499475628652996322645265504",
"67375320668609752978282465410270834414",
"120552197073837783068915436307065730213",
"126287348359886453068673444172571704445",
"50757414922992344976773212318036965487"
],
"threshold": 0.9
},
"id": "ASB-A-269456968-e973a787",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/75e56c8ef4c213ccf72b12fbe076d125c5192865",
"target": {
"file": "shim_and_sl/ShimConverter.cpp"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/hardware/interfaces/+/98d133b6182eab38f6af5c56bf1f9a00687ea277"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"ID"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"line_hashes": [
"40592511717342990389942058539945609306",
"1215199241451092441693081628498869121",
"129948529691575016124142609218851295746",
"180984362077311833556099534600156618805",
"196474455315920770780076363565407616005",
"7710838437947647161968512562153547620",
"289101019889694858839139463180580597518"
],
"threshold": 0.9
},
"id": "ASB-A-269456968-4b814d83",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/interfaces/+/98d133b6182eab38f6af5c56bf1f9a00687ea277",
"target": {
"file": "neuralnetworks/aidl/vts/functional/ValidateModel.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "255834689267382053440549860468519338361",
"length": 840
},
"id": "ASB-A-269456968-86dcdde1",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/interfaces/+/98d133b6182eab38f6af5c56bf1f9a00687ea277",
"target": {
"file": "neuralnetworks/aidl/vts/functional/ValidateModel.cpp",
"function": "validateModel"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/0be2d9a3abdc89d33e14b1fac965ce53b52b3f5a"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"ID"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "117549551585405145896197857986194020165",
"length": 2040
},
"id": "ASB-A-269456968-b591eb91",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/0be2d9a3abdc89d33e14b1fac965ce53b52b3f5a",
"target": {
"file": "shim_and_sl/ShimConverter.cpp",
"function": "isValid"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"75187719208275870646090957093481890954",
"340131414929134843437663854480429539680",
"54001838752359329900919718142955712081",
"285250356260115474433082804678168617461",
"109424735767730076176734673742369407379",
"39573811633329355338794009495144039177",
"182830228131374686493677244538863397532",
"98379926951023035715857893892377015667",
"188637344271475611293398993770431629553",
"229387678612352843714756599500284039861",
"85359450305213975842027923137755667731",
"220001508687791037264125116951112954330",
"324735370805818494230502263013918886225",
"101085154751499475628652996322645265504",
"67375320668609752978282465410270834414",
"120552197073837783068915436307065730213",
"126287348359886453068673444172571704445",
"50757414922992344976773212318036965487"
],
"threshold": 0.9
},
"id": "ASB-A-269456968-f00ca319",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/0be2d9a3abdc89d33e14b1fac965ce53b52b3f5a",
"target": {
"file": "shim_and_sl/ShimConverter.cpp"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/hardware/interfaces/+/15f2e6e195f8e674f7612eade4f0ac170ba0a896"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"ID"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "255834689267382053440549860468519338361",
"length": 840
},
"id": "ASB-A-269456968-c2885ffe",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/interfaces/+/15f2e6e195f8e674f7612eade4f0ac170ba0a896",
"target": {
"file": "neuralnetworks/aidl/vts/functional/ValidateModel.cpp",
"function": "validateModel"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"40592511717342990389942058539945609306",
"1215199241451092441693081628498869121",
"129948529691575016124142609218851295746",
"180984362077311833556099534600156618805",
"196474455315920770780076363565407616005",
"7710838437947647161968512562153547620",
"289101019889694858839139463180580597518"
],
"threshold": 0.9
},
"id": "ASB-A-269456968-f55d7d92",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/interfaces/+/15f2e6e195f8e674f7612eade4f0ac170ba0a896",
"target": {
"file": "neuralnetworks/aidl/vts/functional/ValidateModel.cpp"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/3fc1c2b349b1cf6f20ccd017b8c18108237c150a"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"ID"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"line_hashes": [
"75187719208275870646090957093481890954",
"340131414929134843437663854480429539680",
"54001838752359329900919718142955712081",
"285250356260115474433082804678168617461",
"109424735767730076176734673742369407379",
"39573811633329355338794009495144039177",
"182830228131374686493677244538863397532",
"98379926951023035715857893892377015667",
"188637344271475611293398993770431629553",
"229387678612352843714756599500284039861",
"85359450305213975842027923137755667731",
"220001508687791037264125116951112954330",
"324735370805818494230502263013918886225",
"101085154751499475628652996322645265504",
"67375320668609752978282465410270834414",
"120552197073837783068915436307065730213",
"126287348359886453068673444172571704445",
"50757414922992344976773212318036965487"
],
"threshold": 0.9
},
"id": "ASB-A-269456968-5ac3dbaf",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/3fc1c2b349b1cf6f20ccd017b8c18108237c150a",
"target": {
"file": "shim_and_sl/ShimConverter.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "117549551585405145896197857986194020165",
"length": 2040
},
"id": "ASB-A-269456968-5bb6f55c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/3fc1c2b349b1cf6f20ccd017b8c18108237c150a",
"target": {
"file": "shim_and_sl/ShimConverter.cpp",
"function": "isValid"
}
}
]
}