In FuseDaemon.cpp, there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
    "vanir_signatures": [
        {
            "source": "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/37e30a263c455ea9cff8ee887965ce0fefcfcf37",
            "signature_version": "v1",
            "deprecated": false,
            "id": "ASB-A-284989074-b6fb247e",
            "target": {
                "file": "jni/FuseDaemon.cpp"
            },
            "signature_type": "Line",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "93842934062477710188903995703533913748",
                    "1278841832020020227939221192718275183",
                    "92394213477509476419682709966191767913",
                    "320949406496716361468834442309556421432"
                ]
            }
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/37e30a263c455ea9cff8ee887965ce0fefcfcf37"
    ],
    "types": [
        "EoP"
    ],
    "severity": "High",
    "spl": "2025-04-01"
}{
    "vanir_signatures": [
        {
            "source": "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/37e30a263c455ea9cff8ee887965ce0fefcfcf37",
            "signature_version": "v1",
            "deprecated": false,
            "id": "ASB-A-284989074-fcbe1ddb",
            "target": {
                "file": "jni/FuseDaemon.cpp"
            },
            "signature_type": "Line",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "93842934062477710188903995703533913748",
                    "1278841832020020227939221192718275183",
                    "92394213477509476419682709966191767913",
                    "320949406496716361468834442309556421432"
                ]
            }
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/37e30a263c455ea9cff8ee887965ce0fefcfcf37"
    ],
    "types": [
        "EoP"
    ],
    "severity": "High",
    "spl": "2025-04-01"
}{
    "vanir_signatures": [
        {
            "source": "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/37e30a263c455ea9cff8ee887965ce0fefcfcf37",
            "signature_version": "v1",
            "deprecated": false,
            "id": "ASB-A-284989074-3c5d5980",
            "target": {
                "file": "jni/FuseDaemon.cpp"
            },
            "signature_type": "Line",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "93842934062477710188903995703533913748",
                    "1278841832020020227939221192718275183",
                    "92394213477509476419682709966191767913",
                    "320949406496716361468834442309556421432"
                ]
            }
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/37e30a263c455ea9cff8ee887965ce0fefcfcf37"
    ],
    "types": [
        "EoP"
    ],
    "severity": "High",
    "spl": "2025-04-01"
}