ASB-A-466091304

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-466091304.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-466091304
Aliases
  • A-466091304
  • CVE-2026-58839
Published
2026-09-01T00:00:00Z
Modified
2026-09-09T15:15:54Z
Summary
[none]
Details

In forEachLine of MountRegistry.cpp, there is a possible out of bounds read due to a buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android
platform/system/incremental_delivery

Package

Name
platform/system/incremental_delivery

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-next:0
Fixed
17-next:2026-09-01

Affected versions

Other
17-next

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/system/incremental_delivery/+/07f1345a34d3b7dd2054f51730a3a2423d75feb2"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "77901611107430095085820501892191841586",
                "length": 3257
            },
            "id": "ASB-A-466091304-56aa4208",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/system/incremental_delivery/+/07f1345a34d3b7dd2054f51730a3a2423d75feb2",
            "target": {
                "file": "incfs/MountRegistry.cpp",
                "function": "MountRegistry::Mounts::loadFrom"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "12874265435631223553710128538833993797",
                "length": 900
            },
            "id": "ASB-A-466091304-760f0052",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/system/incremental_delivery/+/07f1345a34d3b7dd2054f51730a3a2423d75feb2",
            "target": {
                "file": "incfs/MountRegistry.cpp",
                "function": "forEachLine"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "213494211576338406158818322625149119112",
                    "179033028908046322781903310185765842038",
                    "76203621689151990787784922428356750163",
                    "207642138715070231107481360527976875625",
                    "290465456282574680618849643780810081371",
                    "119695939684742444938310553255852257674",
                    "321496537711863837832097436927912685892",
                    "203388116802623663266026432129982973979",
                    "112973675553680936452319393185061860249",
                    "327815023930355873693114169759353342655",
                    "105130219174071444001332376782260748864"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-466091304-d4b4b348",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/system/incremental_delivery/+/07f1345a34d3b7dd2054f51730a3a2423d75feb2",
            "target": {
                "file": "incfs/MountRegistry.cpp"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-466091304.json"
platform/system/incremental_delivery

Package

Name
platform/system/incremental_delivery

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2026-09-01

Affected versions

Other
15

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/system/incremental_delivery/+/c3b528280e0b621ba78a5a9e080d865f99e69cbd"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "12874265435631223553710128538833993797",
                "length": 900
            },
            "id": "ASB-A-466091304-7a262b2c",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/system/incremental_delivery/+/c3b528280e0b621ba78a5a9e080d865f99e69cbd",
            "target": {
                "file": "incfs/MountRegistry.cpp",
                "function": "forEachLine"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "77901611107430095085820501892191841586",
                "length": 3257
            },
            "id": "ASB-A-466091304-997ec2bd",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/system/incremental_delivery/+/c3b528280e0b621ba78a5a9e080d865f99e69cbd",
            "target": {
                "file": "incfs/MountRegistry.cpp",
                "function": "MountRegistry::Mounts::loadFrom"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "213494211576338406158818322625149119112",
                    "179033028908046322781903310185765842038",
                    "76203621689151990787784922428356750163",
                    "207642138715070231107481360527976875625",
                    "290465456282574680618849643780810081371",
                    "119695939684742444938310553255852257674",
                    "321496537711863837832097436927912685892",
                    "203388116802623663266026432129982973979",
                    "112973675553680936452319393185061860249",
                    "327815023930355873693114169759353342655",
                    "105130219174071444001332376782260748864"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-466091304-e62f54f7",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/system/incremental_delivery/+/c3b528280e0b621ba78a5a9e080d865f99e69cbd",
            "target": {
                "file": "incfs/MountRegistry.cpp"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-466091304.json"
platform/system/incremental_delivery

Package

Name
platform/system/incremental_delivery

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-09-01

Affected versions

Other
16

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/system/incremental_delivery/+/71c3c0252b97e29cefda24bee4f598b925a4d605"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "77901611107430095085820501892191841586",
                "length": 3257
            },
            "id": "ASB-A-466091304-771451eb",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/system/incremental_delivery/+/71c3c0252b97e29cefda24bee4f598b925a4d605",
            "target": {
                "file": "incfs/MountRegistry.cpp",
                "function": "MountRegistry::Mounts::loadFrom"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "213494211576338406158818322625149119112",
                    "179033028908046322781903310185765842038",
                    "76203621689151990787784922428356750163",
                    "207642138715070231107481360527976875625",
                    "290465456282574680618849643780810081371",
                    "119695939684742444938310553255852257674",
                    "321496537711863837832097436927912685892",
                    "203388116802623663266026432129982973979",
                    "112973675553680936452319393185061860249",
                    "327815023930355873693114169759353342655",
                    "105130219174071444001332376782260748864"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-466091304-b2878b4e",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/system/incremental_delivery/+/71c3c0252b97e29cefda24bee4f598b925a4d605",
            "target": {
                "file": "incfs/MountRegistry.cpp"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "12874265435631223553710128538833993797",
                "length": 900
            },
            "id": "ASB-A-466091304-e0695cc7",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/system/incremental_delivery/+/71c3c0252b97e29cefda24bee4f598b925a4d605",
            "target": {
                "file": "incfs/MountRegistry.cpp",
                "function": "forEachLine"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-466091304.json"
platform/system/incremental_delivery

Package

Name
platform/system/incremental_delivery

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-09-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/system/incremental_delivery/+/11ecefff0126fdda36405ca7773746275e33426c"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "12874265435631223553710128538833993797",
                "length": 900
            },
            "id": "ASB-A-466091304-4f307dd0",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/system/incremental_delivery/+/11ecefff0126fdda36405ca7773746275e33426c",
            "target": {
                "file": "incfs/MountRegistry.cpp",
                "function": "forEachLine"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "213494211576338406158818322625149119112",
                    "179033028908046322781903310185765842038",
                    "76203621689151990787784922428356750163",
                    "207642138715070231107481360527976875625",
                    "290465456282574680618849643780810081371",
                    "119695939684742444938310553255852257674",
                    "321496537711863837832097436927912685892",
                    "203388116802623663266026432129982973979",
                    "112973675553680936452319393185061860249",
                    "327815023930355873693114169759353342655",
                    "105130219174071444001332376782260748864"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-466091304-6650e358",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/system/incremental_delivery/+/11ecefff0126fdda36405ca7773746275e33426c",
            "target": {
                "file": "incfs/MountRegistry.cpp"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "77901611107430095085820501892191841586",
                "length": 3257
            },
            "id": "ASB-A-466091304-bfd3b3f7",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/system/incremental_delivery/+/11ecefff0126fdda36405ca7773746275e33426c",
            "target": {
                "file": "incfs/MountRegistry.cpp",
                "function": "MountRegistry::Mounts::loadFrom"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-466091304.json"
platform/system/incremental_delivery

Package

Name
platform/system/incremental_delivery

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2026-09-01

Affected versions

Other
14

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/system/incremental_delivery/+/85cff3c7b99e1883c8358d0a458f92579da29baa"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "12874265435631223553710128538833993797",
                "length": 900
            },
            "id": "ASB-A-466091304-3d294bea",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/system/incremental_delivery/+/85cff3c7b99e1883c8358d0a458f92579da29baa",
            "target": {
                "file": "incfs/MountRegistry.cpp",
                "function": "forEachLine"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "213494211576338406158818322625149119112",
                    "179033028908046322781903310185765842038",
                    "76203621689151990787784922428356750163",
                    "207642138715070231107481360527976875625",
                    "290465456282574680618849643780810081371",
                    "119695939684742444938310553255852257674",
                    "321496537711863837832097436927912685892",
                    "203388116802623663266026432129982973979",
                    "112973675553680936452319393185061860249",
                    "327815023930355873693114169759353342655",
                    "105130219174071444001332376782260748864"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-466091304-63b10e77",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/system/incremental_delivery/+/85cff3c7b99e1883c8358d0a458f92579da29baa",
            "target": {
                "file": "incfs/MountRegistry.cpp"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "77901611107430095085820501892191841586",
                "length": 3257
            },
            "id": "ASB-A-466091304-856c3b09",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/system/incremental_delivery/+/85cff3c7b99e1883c8358d0a458f92579da29baa",
            "target": {
                "file": "incfs/MountRegistry.cpp",
                "function": "MountRegistry::Mounts::loadFrom"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-466091304.json"