ASB-A-506109174

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-506109174.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-506109174
Aliases
  • A-506109174
  • CVE-2026-58822
Published
2026-09-01T00:00:00Z
Modified
2026-09-09T15:15:54Z
Summary
[none]
Details

In multiple functions of ftsmooth.c, there is a possible memory safety issue due to improper casting. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android
platform/external/freetype

Package

Name
platform/external/freetype

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-next:0
Fixed
17-next:2026-09-01

Affected versions

Other
17-next

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/external/freetype/+/3256955df2f9e2f2743603f6a6fc637d1a862fc6"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "RCE"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "146622831831300144023853238563881627470",
                    "56388942065459399236012205610290285822",
                    "292397237868389660909710518098158009447",
                    "219570866647328190243318567981960414297",
                    "62029007458789907284789031892908044626",
                    "286912871915672633602449500751706356632"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-506109174-986c5bed",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/external/freetype/+/3256955df2f9e2f2743603f6a6fc637d1a862fc6",
            "target": {
                "file": "src/smooth/ftsmooth.c"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "102182539091905126291391522742479090802",
                "length": 1151
            },
            "id": "ASB-A-506109174-df78e86d",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/external/freetype/+/3256955df2f9e2f2743603f6a6fc637d1a862fc6",
            "target": {
                "file": "src/smooth/ftsmooth.c",
                "function": "ft_smooth_raster_lcdv"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "215417419846574874227165714915549114949",
                "length": 1366
            },
            "id": "ASB-A-506109174-e824a576",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/external/freetype/+/3256955df2f9e2f2743603f6a6fc637d1a862fc6",
            "target": {
                "file": "src/smooth/ftsmooth.c",
                "function": "ft_smooth_raster_lcd"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-506109174.json"
platform/external/freetype

Package

Name
platform/external/freetype

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2026-09-01

Affected versions

Other
15

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/external/freetype/+/d6d8fdf7c235cd52b53106fcd04078dd281f5ea9"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "RCE"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "102182539091905126291391522742479090802",
                "length": 1151
            },
            "id": "ASB-A-506109174-02dfa03a",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/external/freetype/+/d6d8fdf7c235cd52b53106fcd04078dd281f5ea9",
            "target": {
                "file": "src/smooth/ftsmooth.c",
                "function": "ft_smooth_raster_lcdv"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "146622831831300144023853238563881627470",
                    "56388942065459399236012205610290285822",
                    "292397237868389660909710518098158009447",
                    "219570866647328190243318567981960414297",
                    "62029007458789907284789031892908044626",
                    "286912871915672633602449500751706356632"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-506109174-b91e4828",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/external/freetype/+/d6d8fdf7c235cd52b53106fcd04078dd281f5ea9",
            "target": {
                "file": "src/smooth/ftsmooth.c"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "215417419846574874227165714915549114949",
                "length": 1366
            },
            "id": "ASB-A-506109174-bed7954f",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/external/freetype/+/d6d8fdf7c235cd52b53106fcd04078dd281f5ea9",
            "target": {
                "file": "src/smooth/ftsmooth.c",
                "function": "ft_smooth_raster_lcd"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-506109174.json"
platform/external/freetype

Package

Name
platform/external/freetype

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-09-01

Affected versions

Other
16

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/external/freetype/+/2e80dfa7aa277523ef8a46e827a1be531b75702e"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "RCE"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "102182539091905126291391522742479090802",
                "length": 1151
            },
            "id": "ASB-A-506109174-19f79e02",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/external/freetype/+/2e80dfa7aa277523ef8a46e827a1be531b75702e",
            "target": {
                "file": "src/smooth/ftsmooth.c",
                "function": "ft_smooth_raster_lcdv"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "215417419846574874227165714915549114949",
                "length": 1366
            },
            "id": "ASB-A-506109174-4d9e65fb",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/external/freetype/+/2e80dfa7aa277523ef8a46e827a1be531b75702e",
            "target": {
                "file": "src/smooth/ftsmooth.c",
                "function": "ft_smooth_raster_lcd"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "146622831831300144023853238563881627470",
                    "56388942065459399236012205610290285822",
                    "292397237868389660909710518098158009447",
                    "219570866647328190243318567981960414297",
                    "62029007458789907284789031892908044626",
                    "286912871915672633602449500751706356632"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-506109174-6846f0b7",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/external/freetype/+/2e80dfa7aa277523ef8a46e827a1be531b75702e",
            "target": {
                "file": "src/smooth/ftsmooth.c"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-506109174.json"
platform/external/freetype

Package

Name
platform/external/freetype

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-09-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/external/freetype/+/21992c2fe17764cc0a0cda2428a888e075a37ddc"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "RCE"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "146622831831300144023853238563881627470",
                    "56388942065459399236012205610290285822",
                    "292397237868389660909710518098158009447",
                    "219570866647328190243318567981960414297",
                    "62029007458789907284789031892908044626",
                    "286912871915672633602449500751706356632"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-506109174-5d213baf",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/external/freetype/+/21992c2fe17764cc0a0cda2428a888e075a37ddc",
            "target": {
                "file": "src/smooth/ftsmooth.c"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "102182539091905126291391522742479090802",
                "length": 1151
            },
            "id": "ASB-A-506109174-824d82e9",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/external/freetype/+/21992c2fe17764cc0a0cda2428a888e075a37ddc",
            "target": {
                "file": "src/smooth/ftsmooth.c",
                "function": "ft_smooth_raster_lcdv"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "215417419846574874227165714915549114949",
                "length": 1366
            },
            "id": "ASB-A-506109174-d2306c77",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/external/freetype/+/21992c2fe17764cc0a0cda2428a888e075a37ddc",
            "target": {
                "file": "src/smooth/ftsmooth.c",
                "function": "ft_smooth_raster_lcd"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-506109174.json"
platform/external/freetype

Package

Name
platform/external/freetype

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17:0
Fixed
17:2026-09-01

Affected versions

Other
17

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/external/freetype/+/0c28569cac9bf57a3b7cf57f87bdeae4d779ec36"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "RCE"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "215417419846574874227165714915549114949",
                "length": 1366
            },
            "id": "ASB-A-506109174-8288a785",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/external/freetype/+/0c28569cac9bf57a3b7cf57f87bdeae4d779ec36",
            "target": {
                "file": "src/smooth/ftsmooth.c",
                "function": "ft_smooth_raster_lcd"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "146622831831300144023853238563881627470",
                    "56388942065459399236012205610290285822",
                    "292397237868389660909710518098158009447",
                    "219570866647328190243318567981960414297",
                    "62029007458789907284789031892908044626",
                    "286912871915672633602449500751706356632"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-506109174-837c112b",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/external/freetype/+/0c28569cac9bf57a3b7cf57f87bdeae4d779ec36",
            "target": {
                "file": "src/smooth/ftsmooth.c"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "102182539091905126291391522742479090802",
                "length": 1151
            },
            "id": "ASB-A-506109174-d6e1c442",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/external/freetype/+/0c28569cac9bf57a3b7cf57f87bdeae4d779ec36",
            "target": {
                "file": "src/smooth/ftsmooth.c",
                "function": "ft_smooth_raster_lcdv"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-506109174.json"
platform/external/freetype

Package

Name
platform/external/freetype

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2026-09-01

Affected versions

Other
14

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/external/freetype/+/c147b243ef5a603bb0bb3fcf89c6059ce367f654"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "RCE"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "146622831831300144023853238563881627470",
                    "56388942065459399236012205610290285822",
                    "249031127780233373682035083758657469812",
                    "219570866647328190243318567981960414297",
                    "62029007458789907284789031892908044626",
                    "286912871915672633602449500751706356632"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-506109174-0d9428f2",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/external/freetype/+/c147b243ef5a603bb0bb3fcf89c6059ce367f654",
            "target": {
                "file": "src/smooth/ftsmooth.c"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "102182539091905126291391522742479090802",
                "length": 1151
            },
            "id": "ASB-A-506109174-829efef4",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/external/freetype/+/c147b243ef5a603bb0bb3fcf89c6059ce367f654",
            "target": {
                "file": "src/smooth/ftsmooth.c",
                "function": "ft_smooth_raster_lcdv"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "98745190088134440164957985237078224192",
                "length": 1376
            },
            "id": "ASB-A-506109174-8cb1a341",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/external/freetype/+/c147b243ef5a603bb0bb3fcf89c6059ce367f654",
            "target": {
                "file": "src/smooth/ftsmooth.c",
                "function": "ft_smooth_raster_lcd"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-506109174.json"