In multiple functions of ipphelper.c, there is a possible stack bugger overflow due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"fixes": [
"https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/852c02f88419183d0469e833f232e178cc6f53e0"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "318714576146959092333388397084734276892",
"length": 392
},
"id": "ASB-A-503542266-60194fcf",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/852c02f88419183d0469e833f232e178cc6f53e0",
"target": {
"file": "jni/ipphelper/ipphelper.c",
"function": "addMediaIfNotDuplicate"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "223460226343174318896427208934806637857",
"length": 3727
},
"id": "ASB-A-503542266-606cdb4e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/852c02f88419183d0469e833f232e178cc6f53e0",
"target": {
"file": "jni/ipphelper/ipphelper.c",
"function": "parse_getMediaSupported"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"3122932750886125146867982340547526667",
"278854037664755164011944313294508738918",
"190032713861964511511920936907551196188",
"235031877808563053179871009076656301463",
"280407706021535548824027136490620202011",
"125164917052577894891275486800494765733",
"228172977840114402194899453239178863025",
"30762705718947172485290489850490959200"
],
"threshold": 0.9
},
"id": "ASB-A-503542266-cc21f1d1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/852c02f88419183d0469e833f232e178cc6f53e0",
"target": {
"file": "jni/ipphelper/ipphelper.c"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/ee22adf7b1633851559ede713ef236cda853b5bd"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "318714576146959092333388397084734276892",
"length": 392
},
"id": "ASB-A-503542266-7d0a3f3f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/ee22adf7b1633851559ede713ef236cda853b5bd",
"target": {
"file": "jni/ipphelper/ipphelper.c",
"function": "addMediaIfNotDuplicate"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "331433994153440631022595870541633280355",
"length": 3567
},
"id": "ASB-A-503542266-c766f2b5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/ee22adf7b1633851559ede713ef236cda853b5bd",
"target": {
"file": "jni/ipphelper/ipphelper.c",
"function": "parse_getMediaSupported"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"3122932750886125146867982340547526667",
"278854037664755164011944313294508738918",
"190032713861964511511920936907551196188",
"235031877808563053179871009076656301463",
"280407706021535548824027136490620202011",
"125164917052577894891275486800494765733",
"228172977840114402194899453239178863025",
"30762705718947172485290489850490959200"
],
"threshold": 0.9
},
"id": "ASB-A-503542266-d7267860",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/ee22adf7b1633851559ede713ef236cda853b5bd",
"target": {
"file": "jni/ipphelper/ipphelper.c"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/be23ef2228a6814cc1eafcda3f8835e344abe48b"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "323793181185082495905795815378194397472",
"length": 3751
},
"id": "ASB-A-503542266-22b389ea",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/be23ef2228a6814cc1eafcda3f8835e344abe48b",
"target": {
"file": "jni/ipphelper/ipphelper.c",
"function": "parse_getMediaSupported"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"3122932750886125146867982340547526667",
"278854037664755164011944313294508738918",
"190032713861964511511920936907551196188",
"235031877808563053179871009076656301463",
"280407706021535548824027136490620202011",
"125164917052577894891275486800494765733",
"228172977840114402194899453239178863025",
"30762705718947172485290489850490959200"
],
"threshold": 0.9
},
"id": "ASB-A-503542266-7a3d5801",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/be23ef2228a6814cc1eafcda3f8835e344abe48b",
"target": {
"file": "jni/ipphelper/ipphelper.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "318714576146959092333388397084734276892",
"length": 392
},
"id": "ASB-A-503542266-a87e1c47",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/be23ef2228a6814cc1eafcda3f8835e344abe48b",
"target": {
"file": "jni/ipphelper/ipphelper.c",
"function": "addMediaIfNotDuplicate"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/ad73bae388f290a2fc6eba5c79189ea12dcbbf3e"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "318714576146959092333388397084734276892",
"length": 392
},
"id": "ASB-A-503542266-667ce3a4",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/ad73bae388f290a2fc6eba5c79189ea12dcbbf3e",
"target": {
"file": "jni/ipphelper/ipphelper.c",
"function": "addMediaIfNotDuplicate"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "323793181185082495905795815378194397472",
"length": 3751
},
"id": "ASB-A-503542266-978f3639",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/ad73bae388f290a2fc6eba5c79189ea12dcbbf3e",
"target": {
"file": "jni/ipphelper/ipphelper.c",
"function": "parse_getMediaSupported"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"3122932750886125146867982340547526667",
"278854037664755164011944313294508738918",
"190032713861964511511920936907551196188",
"235031877808563053179871009076656301463",
"280407706021535548824027136490620202011",
"125164917052577894891275486800494765733",
"228172977840114402194899453239178863025",
"30762705718947172485290489850490959200"
],
"threshold": 0.9
},
"id": "ASB-A-503542266-c2164f1c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/ad73bae388f290a2fc6eba5c79189ea12dcbbf3e",
"target": {
"file": "jni/ipphelper/ipphelper.c"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/d3e4806a36b4405b977e987bea7f48984a7a4b44"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "223460226343174318896427208934806637857",
"length": 3727
},
"id": "ASB-A-503542266-3110942b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/d3e4806a36b4405b977e987bea7f48984a7a4b44",
"target": {
"file": "jni/ipphelper/ipphelper.c",
"function": "parse_getMediaSupported"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "318714576146959092333388397084734276892",
"length": 392
},
"id": "ASB-A-503542266-a6356345",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/d3e4806a36b4405b977e987bea7f48984a7a4b44",
"target": {
"file": "jni/ipphelper/ipphelper.c",
"function": "addMediaIfNotDuplicate"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"3122932750886125146867982340547526667",
"278854037664755164011944313294508738918",
"190032713861964511511920936907551196188",
"235031877808563053179871009076656301463",
"280407706021535548824027136490620202011",
"125164917052577894891275486800494765733",
"228172977840114402194899453239178863025",
"30762705718947172485290489850490959200"
],
"threshold": 0.9
},
"id": "ASB-A-503542266-e25493f6",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/d3e4806a36b4405b977e987bea7f48984a7a4b44",
"target": {
"file": "jni/ipphelper/ipphelper.c"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/8bcc48b1b063b668669a708e871e2c76d6e6e293"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "331433994153440631022595870541633280355",
"length": 3567
},
"id": "ASB-A-503542266-235ecacd",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/8bcc48b1b063b668669a708e871e2c76d6e6e293",
"target": {
"file": "jni/ipphelper/ipphelper.c",
"function": "parse_getMediaSupported"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "318714576146959092333388397084734276892",
"length": 392
},
"id": "ASB-A-503542266-76b216fa",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/8bcc48b1b063b668669a708e871e2c76d6e6e293",
"target": {
"file": "jni/ipphelper/ipphelper.c",
"function": "addMediaIfNotDuplicate"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"3122932750886125146867982340547526667",
"278854037664755164011944313294508738918",
"190032713861964511511920936907551196188",
"235031877808563053179871009076656301463",
"280407706021535548824027136490620202011",
"125164917052577894891275486800494765733",
"228172977840114402194899453239178863025",
"30762705718947172485290489850490959200"
],
"threshold": 0.9
},
"id": "ASB-A-503542266-7726daa5",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/8bcc48b1b063b668669a708e871e2c76d6e6e293",
"target": {
"file": "jni/ipphelper/ipphelper.c"
}
}
]
}