ASB-A-463363325

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-463363325.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-463363325
Aliases
  • A-463363325
  • CVE-2026-58821
Published
2026-11-01T00:00:00Z
Modified
2026-11-02T16:56:16Z
Summary
[none]
Details

In multiple functions of SearchRequestDatabaseUtil.java, there is a possible way to access protected data due to SQL injection. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android
platform/packages/providers/MediaProvider

Package

Name
platform/packages/providers/MediaProvider

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-qpr2-next:0
Fixed
17-qpr2-next:2026-11-01

Affected versions

Other
17-qpr2-next

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/269a581419a7b43bdfeae42aac0058041b2f30d7"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "ID"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "189740579461115909734292135186021905372",
                "length":  1276
            },
            "id":  "ASB-A-463363325-3b89a352",
            "match_only_versions":  [
                "17-qpr2-next"
            ],
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/269a581419a7b43bdfeae42aac0058041b2f30d7",
            "target":  {
                "file":  "src/com/android/providers/media/photopicker/v2/sqlite/SearchRequestDatabaseUtil.java",
                "function":  "addSearchRequestIDWhereClause"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "210950047188613910655174200572613816358",
                "length":  212
            },
            "id":  "ASB-A-463363325-3bd5ac8b",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/269a581419a7b43bdfeae42aac0058041b2f30d7",
            "target":  {
                "file":  "src/com/android/providers/media/photopicker/v2/sqlite/SearchRequestDatabaseUtil.java",
                "function":  "addWhereClause"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "76916365870034971198637684103886033135",
                    "128922828884659408288050209043016768915",
                    "217931323205289835552310038977271664885",
                    "318790452508622618792570407031190907601",
                    "14677126980517322556569812481696060860",
                    "255722069000824933372395904868908598545",
                    "171048033038404624932238060707318581954",
                    "69378524261551302396044391961654699783",
                    "71041784633586202127679008814836717912",
                    "276527407471848080530730929749736260652",
                    "319605298363515758662532957772964769170",
                    "128205699815556284236109166532913862814",
                    "339695431892243403354181387792530575991",
                    "279998751066028923428935587419996716192",
                    "23269302097002900105730806992712367180",
                    "135395322301929792626159590884046151442",
                    "149812537929952261424079010877492257397",
                    "293285477897649419218350364825450368496",
                    "212603311783952654257431848135963393613",
                    "317485110783021424248366720322106516291",
                    "72158728852810912070998669554112173300",
                    "38287029669499789899132716117640744016",
                    "156553187957709353709624213439640777468",
                    "292835552961734979416639329203702663037",
                    "213235143565608166079200140108585600166",
                    "66183904103364599588108713597162120033",
                    "147391520002679308898086101312389191988",
                    "60617770341470730220877491565867070372",
                    "63032668325265647257214524225500145135",
                    "45691847782844977569278292612179001240",
                    "90835769712886224221685446776163440252",
                    "263785966325387192560124370737423349310",
                    "90756788071140159586175171957544242750",
                    "303095600871006343587761685968103760864",
                    "63182533702892027775670012053469867290",
                    "221900061160826178880277175874228575526",
                    "128954636333821733601391535804327188413",
                    "80749090080275805368426102220028670129",
                    "122374546446950884044484149631946168737",
                    "293475058886872495219852208599124513913",
                    "332238100481420310684068975939204017627",
                    "227074683579606258644008935206797877590"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-463363325-7eca31bf",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/269a581419a7b43bdfeae42aac0058041b2f30d7",
            "target":  {
                "file":  "src/com/android/providers/media/photopicker/v2/sqlite/SearchRequestDatabaseUtil.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "162760856670847349653271982318324196451",
                "length":  933
            },
            "id":  "ASB-A-463363325-c062488a",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/269a581419a7b43bdfeae42aac0058041b2f30d7",
            "target":  {
                "file":  "src/com/android/providers/media/photopicker/v2/sqlite/SearchRequestDatabaseUtil.java",
                "function":  "getSearchRequestID"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-463363325.json"
platform/packages/providers/MediaProvider

Package

Name
platform/packages/providers/MediaProvider

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-11-01

Affected versions

Other
16

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/db4125270edb9ad61d44c5084f7bba5341daa9c0"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "ID"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "162760856670847349653271982318324196451",
                "length":  933
            },
            "id":  "ASB-A-463363325-37930a04",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/db4125270edb9ad61d44c5084f7bba5341daa9c0",
            "target":  {
                "file":  "src/com/android/providers/media/photopicker/v2/sqlite/SearchRequestDatabaseUtil.java",
                "function":  "getSearchRequestID"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "76916365870034971198637684103886033135",
                    "128922828884659408288050209043016768915",
                    "217931323205289835552310038977271664885",
                    "318790452508622618792570407031190907601",
                    "14677126980517322556569812481696060860",
                    "255722069000824933372395904868908598545",
                    "171048033038404624932238060707318581954",
                    "69378524261551302396044391961654699783",
                    "71041784633586202127679008814836717912",
                    "276527407471848080530730929749736260652",
                    "319605298363515758662532957772964769170",
                    "128205699815556284236109166532913862814",
                    "125225221194248178477065318859072732940",
                    "160468545528526899065973188028656901371",
                    "26556923393991993163266964239683102825",
                    "94265117873179881763208459735231309873",
                    "149812537929952261424079010877492257397",
                    "293285477897649419218350364825450368496",
                    "212603311783952654257431848135963393613",
                    "317485110783021424248366720322106516291",
                    "72158728852810912070998669554112173300",
                    "38287029669499789899132716117640744016",
                    "156553187957709353709624213439640777468",
                    "292835552961734979416639329203702663037",
                    "213235143565608166079200140108585600166",
                    "66183904103364599588108713597162120033",
                    "147391520002679308898086101312389191988",
                    "60617770341470730220877491565867070372",
                    "63032668325265647257214524225500145135",
                    "45691847782844977569278292612179001240",
                    "90835769712886224221685446776163440252",
                    "263785966325387192560124370737423349310",
                    "90756788071140159586175171957544242750",
                    "303095600871006343587761685968103760864",
                    "63182533702892027775670012053469867290",
                    "221900061160826178880277175874228575526",
                    "128954636333821733601391535804327188413",
                    "80749090080275805368426102220028670129",
                    "122374546446950884044484149631946168737",
                    "293475058886872495219852208599124513913",
                    "332238100481420310684068975939204017627",
                    "227074683579606258644008935206797877590"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-463363325-6d032ee1",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/db4125270edb9ad61d44c5084f7bba5341daa9c0",
            "target":  {
                "file":  "src/com/android/providers/media/photopicker/v2/sqlite/SearchRequestDatabaseUtil.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "210950047188613910655174200572613816358",
                "length":  212
            },
            "id":  "ASB-A-463363325-8b5f3891",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/db4125270edb9ad61d44c5084f7bba5341daa9c0",
            "target":  {
                "file":  "src/com/android/providers/media/photopicker/v2/sqlite/SearchRequestDatabaseUtil.java",
                "function":  "addWhereClause"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "171231985333939436695006900228040759553",
                "length":  1266
            },
            "id":  "ASB-A-463363325-c80346ff",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/db4125270edb9ad61d44c5084f7bba5341daa9c0",
            "target":  {
                "file":  "src/com/android/providers/media/photopicker/v2/sqlite/SearchRequestDatabaseUtil.java",
                "function":  "addSearchRequestIDWhereClause"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-463363325.json"
platform/packages/providers/MediaProvider

Package

Name
platform/packages/providers/MediaProvider

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-11-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/f0b4f4bcd7d16f72e92e2c2f8545dc76030baf62"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "ID"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "76916365870034971198637684103886033135",
                    "128922828884659408288050209043016768915",
                    "217931323205289835552310038977271664885",
                    "318790452508622618792570407031190907601",
                    "14677126980517322556569812481696060860",
                    "255722069000824933372395904868908598545",
                    "171048033038404624932238060707318581954",
                    "69378524261551302396044391961654699783",
                    "71041784633586202127679008814836717912",
                    "276527407471848080530730929749736260652",
                    "319605298363515758662532957772964769170",
                    "128205699815556284236109166532913862814",
                    "125225221194248178477065318859072732940",
                    "160468545528526899065973188028656901371",
                    "26556923393991993163266964239683102825",
                    "94265117873179881763208459735231309873",
                    "149812537929952261424079010877492257397",
                    "293285477897649419218350364825450368496",
                    "212603311783952654257431848135963393613",
                    "317485110783021424248366720322106516291",
                    "72158728852810912070998669554112173300",
                    "38287029669499789899132716117640744016",
                    "156553187957709353709624213439640777468",
                    "292835552961734979416639329203702663037",
                    "213235143565608166079200140108585600166",
                    "66183904103364599588108713597162120033",
                    "147391520002679308898086101312389191988",
                    "60617770341470730220877491565867070372",
                    "63032668325265647257214524225500145135",
                    "45691847782844977569278292612179001240",
                    "90835769712886224221685446776163440252",
                    "263785966325387192560124370737423349310",
                    "90756788071140159586175171957544242750",
                    "303095600871006343587761685968103760864",
                    "63182533702892027775670012053469867290",
                    "221900061160826178880277175874228575526",
                    "128954636333821733601391535804327188413",
                    "80749090080275805368426102220028670129",
                    "122374546446950884044484149631946168737",
                    "293475058886872495219852208599124513913",
                    "332238100481420310684068975939204017627",
                    "227074683579606258644008935206797877590"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-463363325-3ab2dd09",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/f0b4f4bcd7d16f72e92e2c2f8545dc76030baf62",
            "target":  {
                "file":  "src/com/android/providers/media/photopicker/v2/sqlite/SearchRequestDatabaseUtil.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "171231985333939436695006900228040759553",
                "length":  1266
            },
            "id":  "ASB-A-463363325-6a800942",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/f0b4f4bcd7d16f72e92e2c2f8545dc76030baf62",
            "target":  {
                "file":  "src/com/android/providers/media/photopicker/v2/sqlite/SearchRequestDatabaseUtil.java",
                "function":  "addSearchRequestIDWhereClause"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "162760856670847349653271982318324196451",
                "length":  933
            },
            "id":  "ASB-A-463363325-c7218d83",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/f0b4f4bcd7d16f72e92e2c2f8545dc76030baf62",
            "target":  {
                "file":  "src/com/android/providers/media/photopicker/v2/sqlite/SearchRequestDatabaseUtil.java",
                "function":  "getSearchRequestID"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "210950047188613910655174200572613816358",
                "length":  212
            },
            "id":  "ASB-A-463363325-def0c796",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/f0b4f4bcd7d16f72e92e2c2f8545dc76030baf62",
            "target":  {
                "file":  "src/com/android/providers/media/photopicker/v2/sqlite/SearchRequestDatabaseUtil.java",
                "function":  "addWhereClause"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-463363325.json"
platform/packages/providers/MediaProvider

Package

Name
platform/packages/providers/MediaProvider

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17:0
Fixed
17:2026-11-01

Affected versions

Other
17

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/aed6177baf33a7a3a8cd1d43a74cb0c6d0ebf24e"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "ID"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "171231985333939436695006900228040759553",
                "length":  1266
            },
            "id":  "ASB-A-463363325-4307906b",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/aed6177baf33a7a3a8cd1d43a74cb0c6d0ebf24e",
            "target":  {
                "file":  "src/com/android/providers/media/photopicker/v2/sqlite/SearchRequestDatabaseUtil.java",
                "function":  "addSearchRequestIDWhereClause"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "76916365870034971198637684103886033135",
                    "128922828884659408288050209043016768915",
                    "217931323205289835552310038977271664885",
                    "318790452508622618792570407031190907601",
                    "14677126980517322556569812481696060860",
                    "255722069000824933372395904868908598545",
                    "171048033038404624932238060707318581954",
                    "69378524261551302396044391961654699783",
                    "71041784633586202127679008814836717912",
                    "276527407471848080530730929749736260652",
                    "319605298363515758662532957772964769170",
                    "128205699815556284236109166532913862814",
                    "125225221194248178477065318859072732940",
                    "160468545528526899065973188028656901371",
                    "26556923393991993163266964239683102825",
                    "94265117873179881763208459735231309873",
                    "149812537929952261424079010877492257397",
                    "293285477897649419218350364825450368496",
                    "212603311783952654257431848135963393613",
                    "317485110783021424248366720322106516291",
                    "72158728852810912070998669554112173300",
                    "38287029669499789899132716117640744016",
                    "156553187957709353709624213439640777468",
                    "292835552961734979416639329203702663037",
                    "213235143565608166079200140108585600166",
                    "66183904103364599588108713597162120033",
                    "147391520002679308898086101312389191988",
                    "60617770341470730220877491565867070372",
                    "63032668325265647257214524225500145135",
                    "45691847782844977569278292612179001240",
                    "90835769712886224221685446776163440252",
                    "263785966325387192560124370737423349310",
                    "90756788071140159586175171957544242750",
                    "303095600871006343587761685968103760864",
                    "63182533702892027775670012053469867290",
                    "221900061160826178880277175874228575526",
                    "128954636333821733601391535804327188413",
                    "80749090080275805368426102220028670129",
                    "122374546446950884044484149631946168737",
                    "293475058886872495219852208599124513913",
                    "332238100481420310684068975939204017627",
                    "227074683579606258644008935206797877590"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-463363325-851fb38d",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/aed6177baf33a7a3a8cd1d43a74cb0c6d0ebf24e",
            "target":  {
                "file":  "src/com/android/providers/media/photopicker/v2/sqlite/SearchRequestDatabaseUtil.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "210950047188613910655174200572613816358",
                "length":  212
            },
            "id":  "ASB-A-463363325-a01b164d",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/aed6177baf33a7a3a8cd1d43a74cb0c6d0ebf24e",
            "target":  {
                "file":  "src/com/android/providers/media/photopicker/v2/sqlite/SearchRequestDatabaseUtil.java",
                "function":  "addWhereClause"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "162760856670847349653271982318324196451",
                "length":  933
            },
            "id":  "ASB-A-463363325-ed11de84",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/aed6177baf33a7a3a8cd1d43a74cb0c6d0ebf24e",
            "target":  {
                "file":  "src/com/android/providers/media/photopicker/v2/sqlite/SearchRequestDatabaseUtil.java",
                "function":  "getSearchRequestID"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-463363325.json"