ASB-A-505452999

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-505452999.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-505452999
Aliases
  • A-505452999
  • CVE-2026-49913
Published
2026-09-01T00:00:00Z
Modified
2026-09-09T15:15:54Z
Summary
[none]
Details

In descramble of DescramblerImpl.cpp, there is a possible arbitrary memory access due to a precondition check failure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android
platform/hardware/interfaces

Package

Name
platform/hardware/interfaces

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-next:0
Fixed
17-next:2026-09-01

Affected versions

Other
17-next

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/hardware/interfaces/+/fde26328df1ff7b0c2efad0c3c71b7826701a913",
        "https://android.googlesource.com/platform/hardware/interfaces/+/fde26328df1ff7b0c2efad0c3c71b7826701a913"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "120931248200929022510929997942191150881",
                    "323380856078108818607644342419255047005",
                    "317490106778496962874910680060832474291",
                    "40969056768917868328164229529465514458",
                    "183291403713482381213026525894201998431",
                    "159424919737662989435519671611428002880",
                    "48981974037470068336655153336410599095",
                    "250547366925226018106844127630191853316"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-505452999-65dcadbd",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/hardware/interfaces/+/fde26328df1ff7b0c2efad0c3c71b7826701a913",
            "target": {
                "file": "cas/aidl/default/DescramblerImpl.cpp"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "280918915529887430848813704025909988090",
                "length": 2543
            },
            "id": "ASB-A-505452999-9dd41f25",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/hardware/interfaces/+/fde26328df1ff7b0c2efad0c3c71b7826701a913",
            "target": {
                "file": "cas/aidl/default/DescramblerImpl.cpp",
                "function": "DescramblerImpl::descramble"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "120931248200929022510929997942191150881",
                    "323380856078108818607644342419255047005",
                    "317490106778496962874910680060832474291",
                    "40969056768917868328164229529465514458",
                    "183291403713482381213026525894201998431",
                    "159424919737662989435519671611428002880",
                    "48981974037470068336655153336410599095",
                    "250547366925226018106844127630191853316"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-505452999-bd6100eb",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/hardware/interfaces/+/fde26328df1ff7b0c2efad0c3c71b7826701a913",
            "target": {
                "file": "cas/aidl/default/DescramblerImpl.cpp"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "280918915529887430848813704025909988090",
                "length": 2543
            },
            "id": "ASB-A-505452999-be844101",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/hardware/interfaces/+/fde26328df1ff7b0c2efad0c3c71b7826701a913",
            "target": {
                "file": "cas/aidl/default/DescramblerImpl.cpp",
                "function": "DescramblerImpl::descramble"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-505452999.json"
platform/hardware/interfaces

Package

Name
platform/hardware/interfaces

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2026-09-01

Affected versions

Other
15

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/hardware/interfaces/+/274e912bcd01b6733149cc5d961f606ddef6a2d9"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "280918915529887430848813704025909988090",
                "length": 2543
            },
            "id": "ASB-A-505452999-85443b6a",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/hardware/interfaces/+/274e912bcd01b6733149cc5d961f606ddef6a2d9",
            "target": {
                "file": "cas/aidl/default/DescramblerImpl.cpp",
                "function": "DescramblerImpl::descramble"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "120931248200929022510929997942191150881",
                    "323380856078108818607644342419255047005",
                    "317490106778496962874910680060832474291",
                    "40969056768917868328164229529465514458",
                    "183291403713482381213026525894201998431",
                    "159424919737662989435519671611428002880",
                    "48981974037470068336655153336410599095",
                    "250547366925226018106844127630191853316"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-505452999-d338e70e",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/hardware/interfaces/+/274e912bcd01b6733149cc5d961f606ddef6a2d9",
            "target": {
                "file": "cas/aidl/default/DescramblerImpl.cpp"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-505452999.json"
platform/hardware/interfaces

Package

Name
platform/hardware/interfaces

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-09-01

Affected versions

Other
16

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/hardware/interfaces/+/50498aaede1d4817ce5f37031080647759a8cf90",
        "https://android.googlesource.com/platform/hardware/interfaces/+/50498aaede1d4817ce5f37031080647759a8cf90"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "120931248200929022510929997942191150881",
                    "323380856078108818607644342419255047005",
                    "317490106778496962874910680060832474291",
                    "40969056768917868328164229529465514458",
                    "183291403713482381213026525894201998431",
                    "159424919737662989435519671611428002880",
                    "48981974037470068336655153336410599095",
                    "250547366925226018106844127630191853316"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-505452999-3d3543d4",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/hardware/interfaces/+/50498aaede1d4817ce5f37031080647759a8cf90",
            "target": {
                "file": "cas/aidl/default/DescramblerImpl.cpp"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "120931248200929022510929997942191150881",
                    "323380856078108818607644342419255047005",
                    "317490106778496962874910680060832474291",
                    "40969056768917868328164229529465514458",
                    "183291403713482381213026525894201998431",
                    "159424919737662989435519671611428002880",
                    "48981974037470068336655153336410599095",
                    "250547366925226018106844127630191853316"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-505452999-72b0cfab",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/hardware/interfaces/+/50498aaede1d4817ce5f37031080647759a8cf90",
            "target": {
                "file": "cas/aidl/default/DescramblerImpl.cpp"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "280918915529887430848813704025909988090",
                "length": 2543
            },
            "id": "ASB-A-505452999-89cb8dff",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/hardware/interfaces/+/50498aaede1d4817ce5f37031080647759a8cf90",
            "target": {
                "file": "cas/aidl/default/DescramblerImpl.cpp",
                "function": "DescramblerImpl::descramble"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "280918915529887430848813704025909988090",
                "length": 2543
            },
            "id": "ASB-A-505452999-c525cf51",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/hardware/interfaces/+/50498aaede1d4817ce5f37031080647759a8cf90",
            "target": {
                "file": "cas/aidl/default/DescramblerImpl.cpp",
                "function": "DescramblerImpl::descramble"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-505452999.json"
platform/hardware/interfaces

Package

Name
platform/hardware/interfaces

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-09-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/hardware/interfaces/+/48e1a6a7950a7400103fd80b99b60520f97b1f6b",
        "https://android.googlesource.com/platform/hardware/interfaces/+/48e1a6a7950a7400103fd80b99b60520f97b1f6b"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "120931248200929022510929997942191150881",
                    "323380856078108818607644342419255047005",
                    "317490106778496962874910680060832474291",
                    "40969056768917868328164229529465514458",
                    "183291403713482381213026525894201998431",
                    "159424919737662989435519671611428002880",
                    "48981974037470068336655153336410599095",
                    "250547366925226018106844127630191853316"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-505452999-0a93b6f7",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/hardware/interfaces/+/48e1a6a7950a7400103fd80b99b60520f97b1f6b",
            "target": {
                "file": "cas/aidl/default/DescramblerImpl.cpp"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "280918915529887430848813704025909988090",
                "length": 2543
            },
            "id": "ASB-A-505452999-59548398",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/hardware/interfaces/+/48e1a6a7950a7400103fd80b99b60520f97b1f6b",
            "target": {
                "file": "cas/aidl/default/DescramblerImpl.cpp",
                "function": "DescramblerImpl::descramble"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "120931248200929022510929997942191150881",
                    "323380856078108818607644342419255047005",
                    "317490106778496962874910680060832474291",
                    "40969056768917868328164229529465514458",
                    "183291403713482381213026525894201998431",
                    "159424919737662989435519671611428002880",
                    "48981974037470068336655153336410599095",
                    "250547366925226018106844127630191853316"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-505452999-65fa6e9e",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/hardware/interfaces/+/48e1a6a7950a7400103fd80b99b60520f97b1f6b",
            "target": {
                "file": "cas/aidl/default/DescramblerImpl.cpp"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "280918915529887430848813704025909988090",
                "length": 2543
            },
            "id": "ASB-A-505452999-f5562512",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/hardware/interfaces/+/48e1a6a7950a7400103fd80b99b60520f97b1f6b",
            "target": {
                "file": "cas/aidl/default/DescramblerImpl.cpp",
                "function": "DescramblerImpl::descramble"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-505452999.json"
platform/hardware/interfaces

Package

Name
platform/hardware/interfaces

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17:0
Fixed
17:2026-09-01

Affected versions

Other
17

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/hardware/interfaces/+/5fc6bab9c9a278bf2adc80a6389e24f5decaff3a",
        "https://android.googlesource.com/platform/hardware/interfaces/+/5fc6bab9c9a278bf2adc80a6389e24f5decaff3a"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "280918915529887430848813704025909988090",
                "length": 2543
            },
            "id": "ASB-A-505452999-30a11328",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/hardware/interfaces/+/5fc6bab9c9a278bf2adc80a6389e24f5decaff3a",
            "target": {
                "file": "cas/aidl/default/DescramblerImpl.cpp",
                "function": "DescramblerImpl::descramble"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "120931248200929022510929997942191150881",
                    "323380856078108818607644342419255047005",
                    "317490106778496962874910680060832474291",
                    "40969056768917868328164229529465514458",
                    "183291403713482381213026525894201998431",
                    "159424919737662989435519671611428002880",
                    "48981974037470068336655153336410599095",
                    "250547366925226018106844127630191853316"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-505452999-3ef18cef",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/hardware/interfaces/+/5fc6bab9c9a278bf2adc80a6389e24f5decaff3a",
            "target": {
                "file": "cas/aidl/default/DescramblerImpl.cpp"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "280918915529887430848813704025909988090",
                "length": 2543
            },
            "id": "ASB-A-505452999-e32ac534",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/hardware/interfaces/+/5fc6bab9c9a278bf2adc80a6389e24f5decaff3a",
            "target": {
                "file": "cas/aidl/default/DescramblerImpl.cpp",
                "function": "DescramblerImpl::descramble"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "120931248200929022510929997942191150881",
                    "323380856078108818607644342419255047005",
                    "317490106778496962874910680060832474291",
                    "40969056768917868328164229529465514458",
                    "183291403713482381213026525894201998431",
                    "159424919737662989435519671611428002880",
                    "48981974037470068336655153336410599095",
                    "250547366925226018106844127630191853316"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-505452999-f26af14d",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/hardware/interfaces/+/5fc6bab9c9a278bf2adc80a6389e24f5decaff3a",
            "target": {
                "file": "cas/aidl/default/DescramblerImpl.cpp"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-505452999.json"
platform/hardware/interfaces

Package

Name
platform/hardware/interfaces

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2026-09-01

Affected versions

Other
14

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/hardware/interfaces/+/43c24afc2d3e05f5f3a8311c441d3952d5b99c9b",
        "https://android.googlesource.com/platform/hardware/interfaces/+/43c24afc2d3e05f5f3a8311c441d3952d5b99c9b"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "280918915529887430848813704025909988090",
                "length": 2543
            },
            "id": "ASB-A-505452999-8cc140a9",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/hardware/interfaces/+/43c24afc2d3e05f5f3a8311c441d3952d5b99c9b",
            "target": {
                "file": "cas/aidl/default/DescramblerImpl.cpp",
                "function": "DescramblerImpl::descramble"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "280918915529887430848813704025909988090",
                "length": 2543
            },
            "id": "ASB-A-505452999-9c25c890",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/hardware/interfaces/+/43c24afc2d3e05f5f3a8311c441d3952d5b99c9b",
            "target": {
                "file": "cas/aidl/default/DescramblerImpl.cpp",
                "function": "DescramblerImpl::descramble"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "120931248200929022510929997942191150881",
                    "323380856078108818607644342419255047005",
                    "317490106778496962874910680060832474291",
                    "40969056768917868328164229529465514458",
                    "183291403713482381213026525894201998431",
                    "159424919737662989435519671611428002880",
                    "48981974037470068336655153336410599095",
                    "250547366925226018106844127630191853316"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-505452999-cde1fd7a",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/hardware/interfaces/+/43c24afc2d3e05f5f3a8311c441d3952d5b99c9b",
            "target": {
                "file": "cas/aidl/default/DescramblerImpl.cpp"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "120931248200929022510929997942191150881",
                    "323380856078108818607644342419255047005",
                    "317490106778496962874910680060832474291",
                    "40969056768917868328164229529465514458",
                    "183291403713482381213026525894201998431",
                    "159424919737662989435519671611428002880",
                    "48981974037470068336655153336410599095",
                    "250547366925226018106844127630191853316"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-505452999-eb905934",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/hardware/interfaces/+/43c24afc2d3e05f5f3a8311c441d3952d5b99c9b",
            "target": {
                "file": "cas/aidl/default/DescramblerImpl.cpp"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-505452999.json"