ASB-A-496616027

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-496616027.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-496616027
Aliases
Published
2026-09-01T00:00:00Z
Modified
2026-09-09T15:15:54Z
Summary
[none]
Details

In png_do_expand_palette_rgba8_neon of palette_neon_intrinsics.c, there is a possible out of bounds read and write due to an incorrect bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android
platform/external/libpng

Package

Name
platform/external/libpng

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-next:0
Fixed
17-next:2026-09-01

Affected versions

Other
17-next

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/external/libpng/+/d13d190be0e939c968ca9866a296f5c2974de8e9"
    ],
    "severity": "Critical",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "298359708780267296884315157627833435451",
                    "203203178321805385143526883075393510811",
                    "250242872877104785147844109220919858595",
                    "79048702668278991502446076210527555188",
                    "171919842259648123697619028366239398012",
                    "241268730263835879674777371680796159758",
                    "293042023929336437675212565487597359138",
                    "102080076162553264016683727533188887257",
                    "289421140340610710376227973987476268928",
                    "180482023378579750659669637771709492112",
                    "136583812222870122331793565768299380396",
                    "322726961584630739184609056372871362468",
                    "311039951619311631758162993300496042313",
                    "215349985471551441045135139639116256526",
                    "203660877934709973581203789725256264127",
                    "149369019407912671219455789735649947374",
                    "288217906790959503968015943118871567353",
                    "142502072423275304246426102188211634235",
                    "102080076162553264016683727533188887257",
                    "289421140340610710376227973987476268928",
                    "180482023378579750659669637771709492112",
                    "264103051453817654756190448191240629301",
                    "41928230139577688963226065437266305186"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-496616027-1004fa92",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/external/libpng/+/d13d190be0e939c968ca9866a296f5c2974de8e9",
            "target": {
                "file": "arm/palette_neon_intrinsics.c"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "128613901959813948094254356666012276707",
                "length": 841
            },
            "id": "ASB-A-496616027-336e7ab7",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/external/libpng/+/d13d190be0e939c968ca9866a296f5c2974de8e9",
            "target": {
                "file": "arm/palette_neon_intrinsics.c",
                "function": "png_do_expand_palette_rgba8_neon"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "191788870158240393335986482985216797006",
                "length": 1253
            },
            "id": "ASB-A-496616027-44ffb86b",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/external/libpng/+/d13d190be0e939c968ca9866a296f5c2974de8e9",
            "target": {
                "file": "arm/palette_neon_intrinsics.c",
                "function": "png_do_expand_palette_rgb8_neon"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-496616027.json"
platform/external/libpng

Package

Name
platform/external/libpng

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2026-09-01

Affected versions

Other
15

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/external/libpng/+/10f4ca892a321c39de546a1a8e4d632bfc0852df"
    ],
    "severity": "Critical",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "191788870158240393335986482985216797006",
                "length": 1253
            },
            "id": "ASB-A-496616027-48fea7fa",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/external/libpng/+/10f4ca892a321c39de546a1a8e4d632bfc0852df",
            "target": {
                "file": "arm/palette_neon_intrinsics.c",
                "function": "png_do_expand_palette_rgb8_neon"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "73469605830962399111124384080506878068",
                "length": 825
            },
            "id": "ASB-A-496616027-a1ae7716",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/external/libpng/+/10f4ca892a321c39de546a1a8e4d632bfc0852df",
            "target": {
                "file": "arm/palette_neon_intrinsics.c",
                "function": "png_do_expand_palette_rgba8_neon"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "298359708780267296884315157627833435451",
                    "203203178321805385143526883075393510811",
                    "250242872877104785147844109220919858595",
                    "79048702668278991502446076210527555188",
                    "171919842259648123697619028366239398012",
                    "241268730263835879674777371680796159758",
                    "293042023929336437675212565487597359138",
                    "102080076162553264016683727533188887257",
                    "289421140340610710376227973987476268928",
                    "180482023378579750659669637771709492112",
                    "136583812222870122331793565768299380396",
                    "322726961584630739184609056372871362468",
                    "311039951619311631758162993300496042313",
                    "215349985471551441045135139639116256526",
                    "203660877934709973581203789725256264127",
                    "149369019407912671219455789735649947374",
                    "288217906790959503968015943118871567353",
                    "142502072423275304246426102188211634235",
                    "102080076162553264016683727533188887257",
                    "289421140340610710376227973987476268928",
                    "180482023378579750659669637771709492112",
                    "264103051453817654756190448191240629301",
                    "41928230139577688963226065437266305186"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-496616027-ccaea1a4",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/external/libpng/+/10f4ca892a321c39de546a1a8e4d632bfc0852df",
            "target": {
                "file": "arm/palette_neon_intrinsics.c"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-496616027.json"
platform/external/libpng

Package

Name
platform/external/libpng

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-09-01

Affected versions

Other
16

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/external/libpng/+/59b59b6c027aaf36e8514d7d527499bd646cdf06"
    ],
    "severity": "Critical",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "73469605830962399111124384080506878068",
                "length": 825
            },
            "id": "ASB-A-496616027-7d8c0ab5",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/external/libpng/+/59b59b6c027aaf36e8514d7d527499bd646cdf06",
            "target": {
                "file": "arm/palette_neon_intrinsics.c",
                "function": "png_do_expand_palette_rgba8_neon"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "298359708780267296884315157627833435451",
                    "203203178321805385143526883075393510811",
                    "250242872877104785147844109220919858595",
                    "79048702668278991502446076210527555188",
                    "171919842259648123697619028366239398012",
                    "241268730263835879674777371680796159758",
                    "293042023929336437675212565487597359138",
                    "102080076162553264016683727533188887257",
                    "289421140340610710376227973987476268928",
                    "180482023378579750659669637771709492112",
                    "136583812222870122331793565768299380396",
                    "322726961584630739184609056372871362468",
                    "311039951619311631758162993300496042313",
                    "215349985471551441045135139639116256526",
                    "203660877934709973581203789725256264127",
                    "149369019407912671219455789735649947374",
                    "288217906790959503968015943118871567353",
                    "142502072423275304246426102188211634235",
                    "102080076162553264016683727533188887257",
                    "289421140340610710376227973987476268928",
                    "180482023378579750659669637771709492112",
                    "264103051453817654756190448191240629301",
                    "41928230139577688963226065437266305186"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-496616027-c1359d44",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/external/libpng/+/59b59b6c027aaf36e8514d7d527499bd646cdf06",
            "target": {
                "file": "arm/palette_neon_intrinsics.c"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "191788870158240393335986482985216797006",
                "length": 1253
            },
            "id": "ASB-A-496616027-dd546884",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/external/libpng/+/59b59b6c027aaf36e8514d7d527499bd646cdf06",
            "target": {
                "file": "arm/palette_neon_intrinsics.c",
                "function": "png_do_expand_palette_rgb8_neon"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-496616027.json"
platform/external/libpng

Package

Name
platform/external/libpng

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-09-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/external/libpng/+/f5d4f5f7822964cb3753a5b93eab39fbef377aec"
    ],
    "severity": "Critical",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "191788870158240393335986482985216797006",
                "length": 1253
            },
            "id": "ASB-A-496616027-037ce57f",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/external/libpng/+/f5d4f5f7822964cb3753a5b93eab39fbef377aec",
            "target": {
                "file": "arm/palette_neon_intrinsics.c",
                "function": "png_do_expand_palette_rgb8_neon"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "128613901959813948094254356666012276707",
                "length": 841
            },
            "id": "ASB-A-496616027-62af06a9",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/external/libpng/+/f5d4f5f7822964cb3753a5b93eab39fbef377aec",
            "target": {
                "file": "arm/palette_neon_intrinsics.c",
                "function": "png_do_expand_palette_rgba8_neon"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "298359708780267296884315157627833435451",
                    "203203178321805385143526883075393510811",
                    "250242872877104785147844109220919858595",
                    "79048702668278991502446076210527555188",
                    "171919842259648123697619028366239398012",
                    "241268730263835879674777371680796159758",
                    "293042023929336437675212565487597359138",
                    "102080076162553264016683727533188887257",
                    "289421140340610710376227973987476268928",
                    "180482023378579750659669637771709492112",
                    "136583812222870122331793565768299380396",
                    "322726961584630739184609056372871362468",
                    "311039951619311631758162993300496042313",
                    "215349985471551441045135139639116256526",
                    "203660877934709973581203789725256264127",
                    "149369019407912671219455789735649947374",
                    "288217906790959503968015943118871567353",
                    "142502072423275304246426102188211634235",
                    "102080076162553264016683727533188887257",
                    "289421140340610710376227973987476268928",
                    "180482023378579750659669637771709492112",
                    "264103051453817654756190448191240629301",
                    "41928230139577688963226065437266305186"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-496616027-ee961c9c",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/external/libpng/+/f5d4f5f7822964cb3753a5b93eab39fbef377aec",
            "target": {
                "file": "arm/palette_neon_intrinsics.c"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-496616027.json"
platform/external/libpng

Package

Name
platform/external/libpng

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17:0
Fixed
17:2026-09-01

Affected versions

Other
17

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/external/libpng/+/7d98050ef8d9d17d495eb178b8217548437cedf1"
    ],
    "severity": "Critical",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "128613901959813948094254356666012276707",
                "length": 841
            },
            "id": "ASB-A-496616027-3179c2c9",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/external/libpng/+/7d98050ef8d9d17d495eb178b8217548437cedf1",
            "target": {
                "file": "arm/palette_neon_intrinsics.c",
                "function": "png_do_expand_palette_rgba8_neon"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "191788870158240393335986482985216797006",
                "length": 1253
            },
            "id": "ASB-A-496616027-8e75770f",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/external/libpng/+/7d98050ef8d9d17d495eb178b8217548437cedf1",
            "target": {
                "file": "arm/palette_neon_intrinsics.c",
                "function": "png_do_expand_palette_rgb8_neon"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "298359708780267296884315157627833435451",
                    "203203178321805385143526883075393510811",
                    "250242872877104785147844109220919858595",
                    "79048702668278991502446076210527555188",
                    "171919842259648123697619028366239398012",
                    "241268730263835879674777371680796159758",
                    "293042023929336437675212565487597359138",
                    "102080076162553264016683727533188887257",
                    "289421140340610710376227973987476268928",
                    "180482023378579750659669637771709492112",
                    "136583812222870122331793565768299380396",
                    "322726961584630739184609056372871362468",
                    "311039951619311631758162993300496042313",
                    "215349985471551441045135139639116256526",
                    "203660877934709973581203789725256264127",
                    "149369019407912671219455789735649947374",
                    "288217906790959503968015943118871567353",
                    "142502072423275304246426102188211634235",
                    "102080076162553264016683727533188887257",
                    "289421140340610710376227973987476268928",
                    "180482023378579750659669637771709492112",
                    "264103051453817654756190448191240629301",
                    "41928230139577688963226065437266305186"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-496616027-bc28fab2",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/external/libpng/+/7d98050ef8d9d17d495eb178b8217548437cedf1",
            "target": {
                "file": "arm/palette_neon_intrinsics.c"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-496616027.json"
platform/external/libpng

Package

Name
platform/external/libpng

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2026-09-01

Affected versions

Other
14

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/external/libpng/+/878709359441be2cbee8a0fa1b42af6a3bac6c18"
    ],
    "severity": "Critical",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "73469605830962399111124384080506878068",
                "length": 825
            },
            "id": "ASB-A-496616027-4004b8b2",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/external/libpng/+/878709359441be2cbee8a0fa1b42af6a3bac6c18",
            "target": {
                "file": "arm/palette_neon_intrinsics.c",
                "function": "png_do_expand_palette_rgba8_neon"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "298359708780267296884315157627833435451",
                    "203203178321805385143526883075393510811",
                    "250242872877104785147844109220919858595",
                    "79048702668278991502446076210527555188",
                    "171919842259648123697619028366239398012",
                    "241268730263835879674777371680796159758",
                    "293042023929336437675212565487597359138",
                    "102080076162553264016683727533188887257",
                    "289421140340610710376227973987476268928",
                    "180482023378579750659669637771709492112",
                    "136583812222870122331793565768299380396",
                    "322726961584630739184609056372871362468",
                    "311039951619311631758162993300496042313",
                    "215349985471551441045135139639116256526",
                    "203660877934709973581203789725256264127",
                    "149369019407912671219455789735649947374",
                    "288217906790959503968015943118871567353",
                    "142502072423275304246426102188211634235",
                    "102080076162553264016683727533188887257",
                    "289421140340610710376227973987476268928",
                    "180482023378579750659669637771709492112",
                    "264103051453817654756190448191240629301",
                    "41928230139577688963226065437266305186"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-496616027-55a761b5",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/external/libpng/+/878709359441be2cbee8a0fa1b42af6a3bac6c18",
            "target": {
                "file": "arm/palette_neon_intrinsics.c"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "191788870158240393335986482985216797006",
                "length": 1253
            },
            "id": "ASB-A-496616027-9477d6d5",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/external/libpng/+/878709359441be2cbee8a0fa1b42af6a3bac6c18",
            "target": {
                "file": "arm/palette_neon_intrinsics.c",
                "function": "png_do_expand_palette_rgb8_neon"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-496616027.json"