ASB-A-522371916

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-522371916.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-522371916
Aliases
  • A-522371916
  • CVE-2026-58835
Published
2026-10-01T00:00:00Z
Modified
2026-10-05T16:41:13Z
Summary
[none]
Details

In cfg2prop of btif_storage.cc, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android
platform/packages/modules/Bluetooth

Package

Name
platform/packages/modules/Bluetooth

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-next:0
Fixed
17-next:2026-10-01

Affected versions

Other
17-next

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c9a1097e4ce11c2ac0f37a7609b238a7ceb93283"
    ],
    "severity":  "Critical",
    "spl":  "2026-10-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "234365411249603989300082848016241845850",
                    "165996928546326576649106371421315152636",
                    "158131361413690883931020199603272946081",
                    "295861833383985112459878393759501967827"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-522371916-acb7e5cb",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c9a1097e4ce11c2ac0f37a7609b238a7ceb93283",
            "target":  {
                "file":  "system/btif/src/btif_storage.cc"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "223958912590250574146431880509876080730",
                "length":  4806
            },
            "id":  "ASB-A-522371916-c9c59695",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c9a1097e4ce11c2ac0f37a7609b238a7ceb93283",
            "target":  {
                "file":  "system/btif/src/btif_storage.cc",
                "function":  "cfg2prop"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-522371916.json"
platform/packages/modules/Bluetooth

Package

Name
platform/packages/modules/Bluetooth

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-10-01

Affected versions

Other
16

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/95ecd904327158fc73ed6b156502f209fc3f8f6f"
    ],
    "severity":  "Critical",
    "spl":  "2026-10-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "114990799775487248829439979965956309753",
                "length":  5327
            },
            "id":  "ASB-A-522371916-4357aac8",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/95ecd904327158fc73ed6b156502f209fc3f8f6f",
            "target":  {
                "file":  "system/btif/src/btif_storage.cc",
                "function":  "cfg2prop"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "234365411249603989300082848016241845850",
                    "165996928546326576649106371421315152636",
                    "158131361413690883931020199603272946081",
                    "295861833383985112459878393759501967827"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-522371916-58fd875b",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/95ecd904327158fc73ed6b156502f209fc3f8f6f",
            "target":  {
                "file":  "system/btif/src/btif_storage.cc"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-522371916.json"
platform/packages/modules/Bluetooth

Package

Name
platform/packages/modules/Bluetooth

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-10-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/15a1f089db2c8ac5ad2c5cb3df5c4b8825c9be7c"
    ],
    "severity":  "Critical",
    "spl":  "2026-10-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "234365411249603989300082848016241845850",
                    "165996928546326576649106371421315152636",
                    "158131361413690883931020199603272946081",
                    "295861833383985112459878393759501967827"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-522371916-236068a0",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/15a1f089db2c8ac5ad2c5cb3df5c4b8825c9be7c",
            "target":  {
                "file":  "system/btif/src/btif_storage.cc"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "307183483111849039018821062906620333632",
                "length":  5601
            },
            "id":  "ASB-A-522371916-cb571b9a",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/15a1f089db2c8ac5ad2c5cb3df5c4b8825c9be7c",
            "target":  {
                "file":  "system/btif/src/btif_storage.cc",
                "function":  "cfg2prop"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-522371916.json"
platform/packages/modules/Bluetooth

Package

Name
platform/packages/modules/Bluetooth

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17:0
Fixed
17:2026-10-01

Affected versions

Other
17

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f6f30f9f5c32a41a461f7066d1858a9422967467"
    ],
    "severity":  "Critical",
    "spl":  "2026-10-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "118676255921628993911651670726902938863",
                "length":  5040
            },
            "id":  "ASB-A-522371916-4914ea68",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f6f30f9f5c32a41a461f7066d1858a9422967467",
            "target":  {
                "file":  "system/btif/src/btif_storage.cc",
                "function":  "cfg2prop"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "234365411249603989300082848016241845850",
                    "165996928546326576649106371421315152636",
                    "158131361413690883931020199603272946081",
                    "295861833383985112459878393759501967827"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-522371916-8c186c67",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f6f30f9f5c32a41a461f7066d1858a9422967467",
            "target":  {
                "file":  "system/btif/src/btif_storage.cc"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-522371916.json"