ASB-A-514738229

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-514738229.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-514738229
Aliases
  • A-514738229
  • CVE-2026-58986
Published
2026-11-01T00:00:00Z
Modified
2026-11-02T16:56:19Z
Summary
[none]
Details

In notifyPictureProfileHandleSelection of MediaQualityService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-qpr2-next:0
Fixed
17-qpr2-next:2026-11-01

Affected versions

Other
17-qpr2-next

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/f4f0ab21d45103fc84af4486238418fb95be0544"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "324357658243432102337756445572544309746",
                    "152448830456879685040101109300635562693",
                    "238301552452070931647990386623762264068",
                    "149217687815167875097572085584169471977",
                    "196458918112961924860740311398615060283",
                    "122579940017490563447006472107366121299",
                    "60059473715830813855892024481556283171",
                    "181893847494795107251497306910556563013",
                    "340143278927825752622671304543834399249",
                    "291353420537940705837069536945415929219",
                    "24490693036086769464968348266781904106",
                    "54179829846868237458114563853365933545",
                    "260421409558767301373816841456228613315",
                    "276080082049035977080617056570628830979"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-514738229-185a62df",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/f4f0ab21d45103fc84af4486238418fb95be0544",
            "target":  {
                "file":  "services/core/java/com/android/server/media/quality/MediaQualityService.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "37922062061207659278892598815976012623",
                "length":  449
            },
            "id":  "ASB-A-514738229-544debcf",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/f4f0ab21d45103fc84af4486238418fb95be0544",
            "target":  {
                "file":  "services/core/java/com/android/server/media/quality/MediaQualityService.java",
                "function":  "notifyPictureProfileHandleSelection"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-514738229.json"

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-11-01

Affected versions

Other
16

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/78aaddbc99cad2016d141e8ac75c678d9e33a1f5"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "261755331053639540147144342022228776322",
                "length":  180
            },
            "id":  "ASB-A-514738229-bad9c82b",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/78aaddbc99cad2016d141e8ac75c678d9e33a1f5",
            "target":  {
                "file":  "services/core/java/com/android/server/media/quality/MediaQualityService.java",
                "function":  "notifyPictureProfileHandleSelection"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "302392116496546500293359004136785670835",
                    "167635176702487853859376309051253888773",
                    "186653851592961696770063369086974228242",
                    "302385854177627037885299201132527223475",
                    "337425730470926928819337159829646980126",
                    "276080082049035977080617056570628830979"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-514738229-dd9b2c0e",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/78aaddbc99cad2016d141e8ac75c678d9e33a1f5",
            "target":  {
                "file":  "services/core/java/com/android/server/media/quality/MediaQualityService.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-514738229.json"

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-11-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/b2b33186ce41099571cb7c2b58e311ff5a288341"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "37922062061207659278892598815976012623",
                "length":  449
            },
            "id":  "ASB-A-514738229-187d631d",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/b2b33186ce41099571cb7c2b58e311ff5a288341",
            "target":  {
                "file":  "services/core/java/com/android/server/media/quality/MediaQualityService.java",
                "function":  "notifyPictureProfileHandleSelection"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "324357658243432102337756445572544309746",
                    "152448830456879685040101109300635562693",
                    "238301552452070931647990386623762264068",
                    "149217687815167875097572085584169471977",
                    "196458918112961924860740311398615060283",
                    "122579940017490563447006472107366121299",
                    "60059473715830813855892024481556283171",
                    "181893847494795107251497306910556563013",
                    "340143278927825752622671304543834399249",
                    "291353420537940705837069536945415929219",
                    "24490693036086769464968348266781904106",
                    "54179829846868237458114563853365933545",
                    "260421409558767301373816841456228613315",
                    "276080082049035977080617056570628830979"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-514738229-5c53a5d8",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/b2b33186ce41099571cb7c2b58e311ff5a288341",
            "target":  {
                "file":  "services/core/java/com/android/server/media/quality/MediaQualityService.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-514738229.json"

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17:0
Fixed
17:2026-11-01

Affected versions

Other
17

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/94775038e3b1d235b65a7c00bb72d94fc20daa64"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "37922062061207659278892598815976012623",
                "length":  449
            },
            "id":  "ASB-A-514738229-81db880d",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/94775038e3b1d235b65a7c00bb72d94fc20daa64",
            "target":  {
                "file":  "services/core/java/com/android/server/media/quality/MediaQualityService.java",
                "function":  "notifyPictureProfileHandleSelection"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "324357658243432102337756445572544309746",
                    "152448830456879685040101109300635562693",
                    "238301552452070931647990386623762264068",
                    "149217687815167875097572085584169471977",
                    "196458918112961924860740311398615060283",
                    "122579940017490563447006472107366121299",
                    "60059473715830813855892024481556283171",
                    "181893847494795107251497306910556563013",
                    "340143278927825752622671304543834399249",
                    "291353420537940705837069536945415929219",
                    "24490693036086769464968348266781904106",
                    "54179829846868237458114563853365933545",
                    "260421409558767301373816841456228613315",
                    "276080082049035977080617056570628830979"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-514738229-82caca90",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/94775038e3b1d235b65a7c00bb72d94fc20daa64",
            "target":  {
                "file":  "services/core/java/com/android/server/media/quality/MediaQualityService.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-514738229.json"