ASB-A-514861024

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-514861024.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-514861024
Aliases
  • A-514861024
  • CVE-2026-49937
Published
2026-10-01T00:00:00Z
Modified
2026-10-05T16:41:13Z
Summary
[none]
Details

In multiple functions of MessageQueueBase.h, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android
platform/system/libfmq

Package

Name
platform/system/libfmq

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-next:0
Fixed
17-next:2026-10-01

Affected versions

Other
17-next

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/system/libfmq/+/c4412ddafd204b5acbf2fbbdafe3ce694bc0a364"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "ID"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "76206041526892211962646396845472950021",
                    "191907528547176398878570017263759147866",
                    "32531547688005130789249358872211243324",
                    "118169809678537940249736560515862445813",
                    "68822940984096068597527581011535437451",
                    "9555991473144796255311608425495533017",
                    "60049057751997589590320245186725948066",
                    "251556598417090489985932279558640173387",
                    "120984670660931273951859659480743918781",
                    "61388105964995959819153637772251961266",
                    "115503196078699863709844467656199545948"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-514861024-04cdd82c",
            "match_only_versions":  [
                "17-next"
            ],
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/libfmq/+/c4412ddafd204b5acbf2fbbdafe3ce694bc0a364",
            "target":  {
                "file":  "tests/msgq_test_client.cpp"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "45867215650520688777788023400164125596",
                    "140133464956813212667640632040045683136",
                    "270644677685351241147787344024237775428",
                    "305418672955264418933735273582641511343",
                    "25834229121459270055445882568464104031",
                    "69934951959070445512155718714614681533",
                    "224678711229732403720595416488040702023",
                    "235032928215245813665202753175510967638",
                    "62982596592540177813972081673949407608",
                    "245763996035722372298532106121204853576",
                    "116849330672720531274231227524568962138",
                    "101929453765516955171117321362850686385",
                    "74390736163807888829628728104799016777",
                    "118801887538252480555983151005960889197",
                    "228260174008800986097582454956428034809",
                    "152546019295191193675496017617108237698",
                    "92357591836820672827276442257004540190",
                    "132563578786840273871339470800988818048",
                    "211388129820078743066876071758245879606"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-514861024-0bd47236",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/libfmq/+/c4412ddafd204b5acbf2fbbdafe3ce694bc0a364",
            "target":  {
                "file":  "include/fmq/MessageQueueBase.h"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "139911085098309030906339346490630516306",
                "length":  1246
            },
            "id":  "ASB-A-514861024-283255ee",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/libfmq/+/c4412ddafd204b5acbf2fbbdafe3ce694bc0a364",
            "target":  {
                "file":  "include/fmq/MessageQueueBase.h",
                "function":  "beginRead"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "123939678422657434405001169811322595003",
                "length":  1227
            },
            "id":  "ASB-A-514861024-2df46c6d",
            "match_only_versions":  [
                "17-next"
            ],
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/libfmq/+/c4412ddafd204b5acbf2fbbdafe3ce694bc0a364",
            "target":  {
                "file":  "tests/msgq_test_client.cpp",
                "function":  "TYPED_TEST"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "301300884765238787500469677348231182317",
                "length":  547
            },
            "id":  "ASB-A-514861024-cf44903b",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/libfmq/+/c4412ddafd204b5acbf2fbbdafe3ce694bc0a364",
            "target":  {
                "file":  "include/fmq/MessageQueueBase.h",
                "function":  "availableToReadBytes"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-514861024.json"
platform/system/libfmq

Package

Name
platform/system/libfmq

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2026-10-01

Affected versions

Other
15

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/system/libfmq/+/1c74c042be1ef04a80c6387e0ffd1069cb9fcfad"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "ID"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "69729402645744846437019567190237861174",
                "length":  1088
            },
            "id":  "ASB-A-514861024-8e1e9e97",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/libfmq/+/1c74c042be1ef04a80c6387e0ffd1069cb9fcfad",
            "target":  {
                "file":  "include/fmq/MessageQueueBase.h",
                "function":  "beginRead"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "45815788745352691128219145941103992219",
                    "140133464956813212667640632040045683136",
                    "270644677685351241147787344024237775428",
                    "305418672955264418933735273582641511343",
                    "25834229121459270055445882568464104031",
                    "69934951959070445512155718714614681533",
                    "85216015122803612932386534835877634417",
                    "279917927168249908132223467729599692894",
                    "101929453765516955171117321362850686385",
                    "74390736163807888829628728104799016777",
                    "118801887538252480555983151005960889197",
                    "228260174008800986097582454956428034809",
                    "152546019295191193675496017617108237698",
                    "92357591836820672827276442257004540190",
                    "132563578786840273871339470800988818048",
                    "211388129820078743066876071758245879606"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-514861024-a7b86824",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/libfmq/+/1c74c042be1ef04a80c6387e0ffd1069cb9fcfad",
            "target":  {
                "file":  "include/fmq/MessageQueueBase.h"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "131637233386850605503462537491971777005",
                "length":  620
            },
            "id":  "ASB-A-514861024-c008ef99",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/libfmq/+/1c74c042be1ef04a80c6387e0ffd1069cb9fcfad",
            "target":  {
                "file":  "include/fmq/MessageQueueBase.h",
                "function":  "availableToReadBytes"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-514861024.json"
platform/system/libfmq

Package

Name
platform/system/libfmq

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-10-01

Affected versions

Other
16

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/system/libfmq/+/0a35fb4c564387082635018cb6c9aca2659ead94"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "ID"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "287949070367596628806325081634248255873",
                "length":  1020
            },
            "id":  "ASB-A-514861024-6a38a600",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/libfmq/+/0a35fb4c564387082635018cb6c9aca2659ead94",
            "target":  {
                "file":  "include/fmq/MessageQueueBase.h",
                "function":  "beginRead"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "301300884765238787500469677348231182317",
                "length":  547
            },
            "id":  "ASB-A-514861024-76b10134",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/libfmq/+/0a35fb4c564387082635018cb6c9aca2659ead94",
            "target":  {
                "file":  "include/fmq/MessageQueueBase.h",
                "function":  "availableToReadBytes"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "45867215650520688777788023400164125596",
                    "140133464956813212667640632040045683136",
                    "270644677685351241147787344024237775428",
                    "305418672955264418933735273582641511343",
                    "25834229121459270055445882568464104031",
                    "69934951959070445512155718714614681533",
                    "224678711229732403720595416488040702023",
                    "235032928215245813665202753175510967638",
                    "62982596592540177813972081673949407608",
                    "245763996035722372298532106121204853576",
                    "116849330672720531274231227524568962138",
                    "101929453765516955171117321362850686385",
                    "74390736163807888829628728104799016777",
                    "118801887538252480555983151005960889197",
                    "228260174008800986097582454956428034809",
                    "152546019295191193675496017617108237698",
                    "92357591836820672827276442257004540190",
                    "132563578786840273871339470800988818048",
                    "211388129820078743066876071758245879606"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-514861024-e38cd32d",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/libfmq/+/0a35fb4c564387082635018cb6c9aca2659ead94",
            "target":  {
                "file":  "include/fmq/MessageQueueBase.h"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-514861024.json"
platform/system/libfmq

Package

Name
platform/system/libfmq

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-10-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/system/libfmq/+/1e57a1c7890543dba24d8a4476225979e0568ab1"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "ID"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "45867215650520688777788023400164125596",
                    "140133464956813212667640632040045683136",
                    "270644677685351241147787344024237775428",
                    "305418672955264418933735273582641511343",
                    "25834229121459270055445882568464104031",
                    "69934951959070445512155718714614681533",
                    "224678711229732403720595416488040702023",
                    "235032928215245813665202753175510967638",
                    "62982596592540177813972081673949407608",
                    "245763996035722372298532106121204853576",
                    "116849330672720531274231227524568962138",
                    "101929453765516955171117321362850686385",
                    "74390736163807888829628728104799016777",
                    "118801887538252480555983151005960889197",
                    "228260174008800986097582454956428034809",
                    "152546019295191193675496017617108237698",
                    "92357591836820672827276442257004540190",
                    "132563578786840273871339470800988818048",
                    "211388129820078743066876071758245879606"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-514861024-3e4027a6",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/libfmq/+/1e57a1c7890543dba24d8a4476225979e0568ab1",
            "target":  {
                "file":  "include/fmq/MessageQueueBase.h"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "12952492091312389243018081015368007061",
                "length":  1143
            },
            "id":  "ASB-A-514861024-43fb9cc0",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/libfmq/+/1e57a1c7890543dba24d8a4476225979e0568ab1",
            "target":  {
                "file":  "include/fmq/MessageQueueBase.h",
                "function":  "beginRead"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "301300884765238787500469677348231182317",
                "length":  547
            },
            "id":  "ASB-A-514861024-6c022b06",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/libfmq/+/1e57a1c7890543dba24d8a4476225979e0568ab1",
            "target":  {
                "file":  "include/fmq/MessageQueueBase.h",
                "function":  "availableToReadBytes"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-514861024.json"
platform/system/libfmq

Package

Name
platform/system/libfmq

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17:0
Fixed
17:2026-10-01

Affected versions

Other
17

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/system/libfmq/+/92cf2be8cb402c8c324eed46d20bddc4bee6bb58"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "ID"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "45867215650520688777788023400164125596",
                    "140133464956813212667640632040045683136",
                    "270644677685351241147787344024237775428",
                    "305418672955264418933735273582641511343",
                    "25834229121459270055445882568464104031",
                    "69934951959070445512155718714614681533",
                    "224678711229732403720595416488040702023",
                    "235032928215245813665202753175510967638",
                    "62982596592540177813972081673949407608",
                    "245763996035722372298532106121204853576",
                    "116849330672720531274231227524568962138",
                    "101929453765516955171117321362850686385",
                    "74390736163807888829628728104799016777",
                    "118801887538252480555983151005960889197",
                    "228260174008800986097582454956428034809",
                    "152546019295191193675496017617108237698",
                    "92357591836820672827276442257004540190",
                    "132563578786840273871339470800988818048",
                    "211388129820078743066876071758245879606"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-514861024-21058cae",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/libfmq/+/92cf2be8cb402c8c324eed46d20bddc4bee6bb58",
            "target":  {
                "file":  "include/fmq/MessageQueueBase.h"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "301300884765238787500469677348231182317",
                "length":  547
            },
            "id":  "ASB-A-514861024-65ce5229",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/libfmq/+/92cf2be8cb402c8c324eed46d20bddc4bee6bb58",
            "target":  {
                "file":  "include/fmq/MessageQueueBase.h",
                "function":  "availableToReadBytes"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "139911085098309030906339346490630516306",
                "length":  1246
            },
            "id":  "ASB-A-514861024-99fec029",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/libfmq/+/92cf2be8cb402c8c324eed46d20bddc4bee6bb58",
            "target":  {
                "file":  "include/fmq/MessageQueueBase.h",
                "function":  "beginRead"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-514861024.json"
platform/system/libfmq

Package

Name
platform/system/libfmq

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2026-10-01

Affected versions

Other
14

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/system/libfmq/+/7e9c2e78af85bfe39bd33bf5f95dd65a62be3392"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "ID"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "76824368080490118361616513206811986012",
                "length":  1088
            },
            "id":  "ASB-A-514861024-0cf1d729",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/libfmq/+/7e9c2e78af85bfe39bd33bf5f95dd65a62be3392",
            "target":  {
                "file":  "include/fmq/MessageQueueBase.h",
                "function":  "beginRead"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "236790446554061048025514260668192785994",
                    "145374696072744784137128413298272023714",
                    "157559149598288620879374759851558678482",
                    "247644322104168295171153532836549454340",
                    "31762282903101419616984183156013777100",
                    "315050152128380115997968616444699884437",
                    "336358305495026340785883668739171057697",
                    "74390736163807888829628728104799016777",
                    "118801887538252480555983151005960889197",
                    "228260174008800986097582454956428034809",
                    "152546019295191193675496017617108237698",
                    "92357591836820672827276442257004540190",
                    "132563578786840273871339470800988818048",
                    "211388129820078743066876071758245879606"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-514861024-36475657",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/libfmq/+/7e9c2e78af85bfe39bd33bf5f95dd65a62be3392",
            "target":  {
                "file":  "include/fmq/MessageQueueBase.h"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "95745458625735590135592403573869272846",
                "length":  353
            },
            "id":  "ASB-A-514861024-ca0af4e1",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/system/libfmq/+/7e9c2e78af85bfe39bd33bf5f95dd65a62be3392",
            "target":  {
                "file":  "include/fmq/MessageQueueBase.h",
                "function":  "availableToReadBytes"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-514861024.json"