ASB-A-376461726

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-376461726.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-376461726
Aliases
Published
2025-12-01T00:00:00Z
Modified
2026-03-30T15:20:36.199724Z
Summary
[none]
Details

In notifyTimeout of CallRedirectionProcessor.java, there is a possible persistent connection due to improper input validation. This could lead to local escalation of privilege and background activity launches with User execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android
platform/packages/services/Telecomm

Package

Name
platform/packages/services/Telecomm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2-next:0
Fixed
16-qpr2-next:2025-12-01

Affected versions

Other
16-qpr2-next

Ecosystem specific 

{
    "types": [
        "EoP"
    ],
    "fixes": [
        "https://android.googlesource.com/platform/packages/services/Telecomm/+/4a358cfd8e403597651a6962e8e43c11ea906a59",
        "https://android.googlesource.com/platform/packages/services/Telecomm/+/615a452b1eb9a1165b6892b715ca9acb39c9fc48"
    ],
    "spl": "2025-12-01",
    "vanir_signatures": [
        {
            "signature_type": "Line",
            "signature_version": "v1",
            "target": {
                "file": "src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java"
            },
            "id": "ASB-A-376461726-5cef733f",
            "deprecated": false,
            "source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/615a452b1eb9a1165b6892b715ca9acb39c9fc48",
            "digest": {
                "line_hashes": [
                    "133914857003413315646570965718557078818",
                    "315982243663284195210992618241822014595",
                    "266328628859364282669968728475815143824",
                    "9519643085536760170172263363297085188"
                ],
                "threshold": 0.9
            }
        },
        {
            "signature_type": "Function",
            "signature_version": "v1",
            "target": {
                "file": "src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java",
                "function": "notifyTimeout"
            },
            "id": "ASB-A-376461726-923f8518",
            "deprecated": false,
            "source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/615a452b1eb9a1165b6892b715ca9acb39c9fc48",
            "digest": {
                "function_hash": "149316474348384160614910124841553593048",
                "length": 474.0
            }
        },
        {
            "signature_type": "Function",
            "signature_version": "v1",
            "target": {
                "file": "src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java",
                "function": "notifyTimeout"
            },
            "id": "ASB-A-376461726-b32ef57f",
            "deprecated": false,
            "source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/4a358cfd8e403597651a6962e8e43c11ea906a59",
            "digest": {
                "function_hash": "191252294837772896851767483113381809875",
                "length": 257.0
            }
        },
        {
            "signature_type": "Line",
            "signature_version": "v1",
            "target": {
                "file": "src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java"
            },
            "id": "ASB-A-376461726-ff34cb91",
            "deprecated": false,
            "source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/4a358cfd8e403597651a6962e8e43c11ea906a59",
            "digest": {
                "line_hashes": [
                    "172429749700010611250441346059781583843",
                    "59903213920553620876219754985547236589",
                    "212799495587578912626871303567720377655",
                    "311277500521534153850202631705000053314"
                ],
                "threshold": 0.9
            }
        }
    ],
    "severity": "High"
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-376461726.json"
platform/packages/services/Telecomm

Package

Name
platform/packages/services/Telecomm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2025-12-01

Affected versions

Other
15

Ecosystem specific 

{
    "types": [
        "EoP"
    ],
    "fixes": [
        "https://android.googlesource.com/platform/packages/services/Telecomm/+/12e18223ec4167fcedf44b18a8627c5651286451",
        "https://android.googlesource.com/platform/packages/services/Telecomm/+/e27f6e38b5677f9e82f485afded30e77d3d1c419"
    ],
    "spl": "2025-12-01",
    "vanir_signatures": [
        {
            "signature_type": "Line",
            "signature_version": "v1",
            "target": {
                "file": "src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java"
            },
            "id": "ASB-A-376461726-97a50a6e",
            "deprecated": false,
            "source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/12e18223ec4167fcedf44b18a8627c5651286451",
            "digest": {
                "line_hashes": [
                    "172429749700010611250441346059781583843",
                    "59903213920553620876219754985547236589",
                    "212799495587578912626871303567720377655",
                    "311277500521534153850202631705000053314"
                ],
                "threshold": 0.9
            }
        },
        {
            "signature_type": "Function",
            "signature_version": "v1",
            "target": {
                "file": "src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java",
                "function": "notifyTimeout"
            },
            "id": "ASB-A-376461726-a9982ac6",
            "deprecated": false,
            "source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/12e18223ec4167fcedf44b18a8627c5651286451",
            "digest": {
                "function_hash": "191252294837772896851767483113381809875",
                "length": 257.0
            }
        },
        {
            "signature_type": "Function",
            "signature_version": "v1",
            "target": {
                "file": "src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java",
                "function": "notifyTimeout"
            },
            "id": "ASB-A-376461726-e10b2ab2",
            "deprecated": false,
            "source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/e27f6e38b5677f9e82f485afded30e77d3d1c419",
            "digest": {
                "function_hash": "149316474348384160614910124841553593048",
                "length": 474.0
            }
        },
        {
            "signature_type": "Line",
            "signature_version": "v1",
            "target": {
                "file": "src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java"
            },
            "id": "ASB-A-376461726-fdbccc0c",
            "deprecated": false,
            "source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/e27f6e38b5677f9e82f485afded30e77d3d1c419",
            "digest": {
                "line_hashes": [
                    "133914857003413315646570965718557078818",
                    "315982243663284195210992618241822014595",
                    "266328628859364282669968728475815143824",
                    "9519643085536760170172263363297085188"
                ],
                "threshold": 0.9
            }
        }
    ],
    "severity": "High"
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-376461726.json"
platform/packages/services/Telecomm

Package

Name
platform/packages/services/Telecomm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2025-12-01

Affected versions

Other
16

Ecosystem specific 

{
    "types": [
        "EoP"
    ],
    "fixes": [
        "https://android.googlesource.com/platform/packages/services/Telecomm/+/f789378f13380ec741141ec203663248b1734c0f"
    ],
    "spl": "2025-12-01",
    "vanir_signatures": [
        {
            "signature_type": "Function",
            "signature_version": "v1",
            "target": {
                "file": "src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java",
                "function": "notifyTimeout"
            },
            "id": "ASB-A-376461726-058e7e1e",
            "deprecated": false,
            "source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/f789378f13380ec741141ec203663248b1734c0f",
            "digest": {
                "function_hash": "149316474348384160614910124841553593048",
                "length": 474.0
            }
        },
        {
            "signature_type": "Line",
            "signature_version": "v1",
            "target": {
                "file": "src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java"
            },
            "id": "ASB-A-376461726-6306745a",
            "deprecated": false,
            "source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/f789378f13380ec741141ec203663248b1734c0f",
            "digest": {
                "line_hashes": [
                    "133914857003413315646570965718557078818",
                    "315982243663284195210992618241822014595",
                    "266328628859364282669968728475815143824",
                    "9519643085536760170172263363297085188"
                ],
                "threshold": 0.9
            }
        }
    ],
    "severity": "High"
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-376461726.json"
platform/packages/services/Telecomm

Package

Name
platform/packages/services/Telecomm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
13:0
Fixed
13:2025-12-01

Affected versions

Other
13

Ecosystem specific 

{
    "types": [
        "EoP"
    ],
    "fixes": [
        "https://android.googlesource.com/platform/packages/services/Telecomm/+/425b355b0e845595c0e1d698ff2f533a46f58830",
        "https://android.googlesource.com/platform/packages/services/Telecomm/+/202392eba2a1d04a135272efe816efdb7182eb62"
    ],
    "spl": "2025-12-01",
    "vanir_signatures": [
        {
            "signature_type": "Function",
            "signature_version": "v1",
            "target": {
                "file": "src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java",
                "function": "notifyTimeout"
            },
            "id": "ASB-A-376461726-1ee25ee0",
            "deprecated": false,
            "source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/202392eba2a1d04a135272efe816efdb7182eb62",
            "digest": {
                "function_hash": "149316474348384160614910124841553593048",
                "length": 474.0
            }
        },
        {
            "signature_type": "Function",
            "signature_version": "v1",
            "target": {
                "file": "src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java",
                "function": "notifyTimeout"
            },
            "id": "ASB-A-376461726-2d98bdc4",
            "deprecated": false,
            "source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/425b355b0e845595c0e1d698ff2f533a46f58830",
            "digest": {
                "function_hash": "191252294837772896851767483113381809875",
                "length": 257.0
            }
        },
        {
            "signature_type": "Line",
            "signature_version": "v1",
            "target": {
                "file": "src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java"
            },
            "id": "ASB-A-376461726-7e165845",
            "deprecated": false,
            "source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/202392eba2a1d04a135272efe816efdb7182eb62",
            "digest": {
                "line_hashes": [
                    "133914857003413315646570965718557078818",
                    "315982243663284195210992618241822014595",
                    "266328628859364282669968728475815143824",
                    "9519643085536760170172263363297085188"
                ],
                "threshold": 0.9
            }
        },
        {
            "signature_type": "Line",
            "signature_version": "v1",
            "target": {
                "file": "src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java"
            },
            "id": "ASB-A-376461726-fc703e84",
            "deprecated": false,
            "source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/425b355b0e845595c0e1d698ff2f533a46f58830",
            "digest": {
                "line_hashes": [
                    "172429749700010611250441346059781583843",
                    "59903213920553620876219754985547236589",
                    "212799495587578912626871303567720377655",
                    "311277500521534153850202631705000053314"
                ],
                "threshold": 0.9
            }
        }
    ],
    "severity": "High"
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-376461726.json"
platform/packages/services/Telecomm

Package

Name
platform/packages/services/Telecomm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2025-12-01

Affected versions

Other
14

Ecosystem specific 

{
    "types": [
        "EoP"
    ],
    "fixes": [
        "https://android.googlesource.com/platform/packages/services/Telecomm/+/9733de498bc44d9865b0061564ac3344426f4da9",
        "https://android.googlesource.com/platform/packages/services/Telecomm/+/fa832b0e972b1f5058c2028384fa231478aa4ff2"
    ],
    "spl": "2025-12-01",
    "vanir_signatures": [
        {
            "signature_type": "Line",
            "signature_version": "v1",
            "target": {
                "file": "src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java"
            },
            "id": "ASB-A-376461726-34758aa2",
            "deprecated": false,
            "source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/9733de498bc44d9865b0061564ac3344426f4da9",
            "digest": {
                "line_hashes": [
                    "172429749700010611250441346059781583843",
                    "59903213920553620876219754985547236589",
                    "212799495587578912626871303567720377655",
                    "311277500521534153850202631705000053314"
                ],
                "threshold": 0.9
            }
        },
        {
            "signature_type": "Line",
            "signature_version": "v1",
            "target": {
                "file": "src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java"
            },
            "id": "ASB-A-376461726-418550f6",
            "deprecated": false,
            "source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/fa832b0e972b1f5058c2028384fa231478aa4ff2",
            "digest": {
                "line_hashes": [
                    "133914857003413315646570965718557078818",
                    "315982243663284195210992618241822014595",
                    "266328628859364282669968728475815143824",
                    "9519643085536760170172263363297085188"
                ],
                "threshold": 0.9
            }
        },
        {
            "signature_type": "Function",
            "signature_version": "v1",
            "target": {
                "file": "src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java",
                "function": "notifyTimeout"
            },
            "id": "ASB-A-376461726-5e23de8a",
            "deprecated": false,
            "source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/9733de498bc44d9865b0061564ac3344426f4da9",
            "digest": {
                "function_hash": "191252294837772896851767483113381809875",
                "length": 257.0
            }
        },
        {
            "signature_type": "Function",
            "signature_version": "v1",
            "target": {
                "file": "src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java",
                "function": "notifyTimeout"
            },
            "id": "ASB-A-376461726-e2982aaf",
            "deprecated": false,
            "source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/fa832b0e972b1f5058c2028384fa231478aa4ff2",
            "digest": {
                "function_hash": "149316474348384160614910124841553593048",
                "length": 474.0
            }
        }
    ],
    "severity": "High"
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-376461726.json"