ASB-A-509980995

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-509980995.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-509980995
Aliases
  • A-509980995
  • CVE-2026-55266
Published
2026-10-01T00:00:00Z
Modified
2026-10-05T16:41:13Z
Summary
[none]
Details

In qsort of libufdt_sysdeps_vendor.c, there is a possible out-of-bounds write due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android
platform/system/libufdt

Package

Name
platform/system/libufdt

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-next:0
Fixed
17-next:2026-10-01

Affected versions

Other
17-next

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/system/libufdt/+/df9856866b8d8b19058beb8e418c588cd47c60dc"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "DoS"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "137993797009395550428776651770291716163",
                    "193965384120655580524755473377960841859",
                    "200024504230025755980259680530302527962",
                    "292652473577376386515723978346152089008",
                    "313098299662800207090179405850625187848",
                    "241194047026163989788690596247341648628",
                    "281524713045533723474044076505175332651",
                    "307296896859351763571935461447691248140",
                    "265717812399586917900284566277803839097",
                    "326808613316438876634975978328511266906",
                    "323255847457112314371069404249604084910",
                    "257766332763367307610507383215671412809",
                    "240655166247386861863658649374348557277"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-509980995-3812a1fa",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/libufdt/+/df9856866b8d8b19058beb8e418c588cd47c60dc",
            "target":  {
                "file":  "sysdeps/libufdt_sysdeps_vendor.c"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "38291949770363451779359671998067870011",
                "length":  2162
            },
            "id":  "ASB-A-509980995-41fcb4e0",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/libufdt/+/df9856866b8d8b19058beb8e418c588cd47c60dc",
            "target":  {
                "file":  "sysdeps/libufdt_sysdeps_vendor.c",
                "function":  "qsort"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-509980995.json"
platform/system/libufdt

Package

Name
platform/system/libufdt

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2026-10-01

Affected versions

Other
15

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/system/libufdt/+/63a6e6fbe0722ef270f6e804a4a86c5f1afea68b"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "DoS"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "137993797009395550428776651770291716163",
                    "193965384120655580524755473377960841859",
                    "200024504230025755980259680530302527962",
                    "292652473577376386515723978346152089008",
                    "313098299662800207090179405850625187848",
                    "241194047026163989788690596247341648628",
                    "281524713045533723474044076505175332651",
                    "307296896859351763571935461447691248140",
                    "265717812399586917900284566277803839097",
                    "326808613316438876634975978328511266906",
                    "323255847457112314371069404249604084910",
                    "257766332763367307610507383215671412809",
                    "240655166247386861863658649374348557277"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-509980995-83081fc3",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/libufdt/+/63a6e6fbe0722ef270f6e804a4a86c5f1afea68b",
            "target":  {
                "file":  "sysdeps/libufdt_sysdeps_vendor.c"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "38291949770363451779359671998067870011",
                "length":  2162
            },
            "id":  "ASB-A-509980995-90eeccdf",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/libufdt/+/63a6e6fbe0722ef270f6e804a4a86c5f1afea68b",
            "target":  {
                "file":  "sysdeps/libufdt_sysdeps_vendor.c",
                "function":  "qsort"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-509980995.json"
platform/system/libufdt

Package

Name
platform/system/libufdt

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-10-01

Affected versions

Other
16

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/system/libufdt/+/3ddb2cd7727cc2b7d0f5b5330aadb93aa21943ba"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "DoS"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "38291949770363451779359671998067870011",
                "length":  2162
            },
            "id":  "ASB-A-509980995-04daceab",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/libufdt/+/3ddb2cd7727cc2b7d0f5b5330aadb93aa21943ba",
            "target":  {
                "file":  "sysdeps/libufdt_sysdeps_vendor.c",
                "function":  "qsort"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "137993797009395550428776651770291716163",
                    "193965384120655580524755473377960841859",
                    "200024504230025755980259680530302527962",
                    "292652473577376386515723978346152089008",
                    "313098299662800207090179405850625187848",
                    "241194047026163989788690596247341648628",
                    "281524713045533723474044076505175332651",
                    "307296896859351763571935461447691248140",
                    "265717812399586917900284566277803839097",
                    "326808613316438876634975978328511266906",
                    "323255847457112314371069404249604084910",
                    "257766332763367307610507383215671412809",
                    "240655166247386861863658649374348557277"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-509980995-5267d152",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/libufdt/+/3ddb2cd7727cc2b7d0f5b5330aadb93aa21943ba",
            "target":  {
                "file":  "sysdeps/libufdt_sysdeps_vendor.c"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-509980995.json"
platform/system/libufdt

Package

Name
platform/system/libufdt

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-10-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/system/libufdt/+/2de0d867217447eb281ee4fb775fa8a04d6f1b9a"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "DoS"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "38291949770363451779359671998067870011",
                "length":  2162
            },
            "id":  "ASB-A-509980995-5f419eb5",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/libufdt/+/2de0d867217447eb281ee4fb775fa8a04d6f1b9a",
            "target":  {
                "file":  "sysdeps/libufdt_sysdeps_vendor.c",
                "function":  "qsort"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "137993797009395550428776651770291716163",
                    "193965384120655580524755473377960841859",
                    "200024504230025755980259680530302527962",
                    "292652473577376386515723978346152089008",
                    "313098299662800207090179405850625187848",
                    "241194047026163989788690596247341648628",
                    "281524713045533723474044076505175332651",
                    "307296896859351763571935461447691248140",
                    "265717812399586917900284566277803839097",
                    "326808613316438876634975978328511266906",
                    "323255847457112314371069404249604084910",
                    "257766332763367307610507383215671412809",
                    "240655166247386861863658649374348557277"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-509980995-e75a06cf",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/libufdt/+/2de0d867217447eb281ee4fb775fa8a04d6f1b9a",
            "target":  {
                "file":  "sysdeps/libufdt_sysdeps_vendor.c"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-509980995.json"
platform/system/libufdt

Package

Name
platform/system/libufdt

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17:0
Fixed
17:2026-10-01

Affected versions

Other
17

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/system/libufdt/+/90b1784cced8f5d1834a87dbf6fa8e1e74ef5448"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "DoS"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "38291949770363451779359671998067870011",
                "length":  2162
            },
            "id":  "ASB-A-509980995-47019493",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/libufdt/+/90b1784cced8f5d1834a87dbf6fa8e1e74ef5448",
            "target":  {
                "file":  "sysdeps/libufdt_sysdeps_vendor.c",
                "function":  "qsort"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "137993797009395550428776651770291716163",
                    "193965384120655580524755473377960841859",
                    "200024504230025755980259680530302527962",
                    "292652473577376386515723978346152089008",
                    "313098299662800207090179405850625187848",
                    "241194047026163989788690596247341648628",
                    "281524713045533723474044076505175332651",
                    "307296896859351763571935461447691248140",
                    "265717812399586917900284566277803839097",
                    "326808613316438876634975978328511266906",
                    "323255847457112314371069404249604084910",
                    "257766332763367307610507383215671412809",
                    "240655166247386861863658649374348557277"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-509980995-50165515",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/libufdt/+/90b1784cced8f5d1834a87dbf6fa8e1e74ef5448",
            "target":  {
                "file":  "sysdeps/libufdt_sysdeps_vendor.c"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-509980995.json"
platform/system/libufdt

Package

Name
platform/system/libufdt

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2026-10-01

Affected versions

Other
14

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/system/libufdt/+/72740bf01100c7cbd40e1d0fc9e25c17c5a60be0"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "DoS"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "137993797009395550428776651770291716163",
                    "193965384120655580524755473377960841859",
                    "200024504230025755980259680530302527962",
                    "292652473577376386515723978346152089008",
                    "313098299662800207090179405850625187848",
                    "241194047026163989788690596247341648628",
                    "281524713045533723474044076505175332651",
                    "307296896859351763571935461447691248140",
                    "265717812399586917900284566277803839097",
                    "326808613316438876634975978328511266906",
                    "323255847457112314371069404249604084910",
                    "257766332763367307610507383215671412809",
                    "240655166247386861863658649374348557277"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-509980995-0ce7ad58",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/libufdt/+/72740bf01100c7cbd40e1d0fc9e25c17c5a60be0",
            "target":  {
                "file":  "sysdeps/libufdt_sysdeps_vendor.c"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "38291949770363451779359671998067870011",
                "length":  2162
            },
            "id":  "ASB-A-509980995-d8bc2ef7",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/libufdt/+/72740bf01100c7cbd40e1d0fc9e25c17c5a60be0",
            "target":  {
                "file":  "sysdeps/libufdt_sysdeps_vendor.c",
                "function":  "qsort"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-509980995.json"