{"id":"ASB-A-204445255","details":"In extract of MediaMetricsItem.h, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-204445255","CVE-2021-39666"],"modified":"2026-04-21T15:25:42.831358Z","published":"2022-02-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-02-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/av/+/1b3b20e3ffbee16770c382d14ecbc4ec28cea88d"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/av/+/fc120151250f8627b34e72ea3b01060bd9819c22"}],"affected":[{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2022-02-01"}]}],"versions":["11"],"ecosystem_specific":{"vanir_signatures":[{"id":"ASB-A-204445255-5761f310","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/190e90959f3c34781c5276d50a5ee561c438db09","signature_type":"Line","deprecated":false,"digest":{"threshold":0.9,"line_hashes":["204136353810716855786164786871586577235","215846875440197335232163842927274824842","264223079732431226072109983960294940717","279078242709809611935813625985182172229","301878528692328210355255274321929775964","29819135875481859968660863364751678409","234094953220321117540411658320619313985","14797854131081670607870902645584464518","78010039432864323490217757457924404348","200347356440273871678974416796411581158","190428515357712404577941490880860147274","189335325770941352531437499353969204454","170718988616586886867859286050497806289"]},"target":{"file":"media/libmediametrics/include/media/MediaMetricsItem.h"}},{"id":"ASB-A-204445255-f1067b90","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/94e58d6b2497d2e0f7e86e2c979e7f6958c84590","signature_type":"Line","deprecated":false,"digest":{"threshold":0.9,"line_hashes":["25141272262250687500370553775162452651","297098323994764108549693509759951134143","279214440846792480736179900659478232811","186591609414443238872700449654791189457","264223079732431226072109983960294940717","279078242709809611935813625985182172229","301878528692328210355255274321929775964","29819135875481859968660863364751678409"]},"target":{"file":"media/libmediametrics/include/media/MediaMetricsItem.h"}}],"types":["ID"],"spl":"2022-02-01","fixes":["https://android.googlesource.com/platform/frameworks/av/+/190e90959f3c34781c5276d50a5ee561c438db09","https://android.googlesource.com/platform/frameworks/av/+/94e58d6b2497d2e0f7e86e2c979e7f6958c84590"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-204445255.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2022-02-01"}]}],"versions":["12"],"ecosystem_specific":{"vanir_signatures":[{"id":"ASB-A-204445255-58b65ed4","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/190e90959f3c34781c5276d50a5ee561c438db09","signature_type":"Line","deprecated":false,"digest":{"threshold":0.9,"line_hashes":["204136353810716855786164786871586577235","215846875440197335232163842927274824842","264223079732431226072109983960294940717","279078242709809611935813625985182172229","301878528692328210355255274321929775964","29819135875481859968660863364751678409","234094953220321117540411658320619313985","14797854131081670607870902645584464518","78010039432864323490217757457924404348","200347356440273871678974416796411581158","190428515357712404577941490880860147274","189335325770941352531437499353969204454","170718988616586886867859286050497806289"]},"target":{"file":"media/libmediametrics/include/media/MediaMetricsItem.h"}},{"id":"ASB-A-204445255-6ae1766f","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/94e58d6b2497d2e0f7e86e2c979e7f6958c84590","signature_type":"Line","deprecated":false,"digest":{"threshold":0.9,"line_hashes":["25141272262250687500370553775162452651","297098323994764108549693509759951134143","279214440846792480736179900659478232811","186591609414443238872700449654791189457","264223079732431226072109983960294940717","279078242709809611935813625985182172229","301878528692328210355255274321929775964","29819135875481859968660863364751678409"]},"target":{"file":"media/libmediametrics/include/media/MediaMetricsItem.h"}}],"types":["ID"],"spl":"2022-02-01","fixes":["https://android.googlesource.com/platform/frameworks/av/+/190e90959f3c34781c5276d50a5ee561c438db09","https://android.googlesource.com/platform/frameworks/av/+/94e58d6b2497d2e0f7e86e2c979e7f6958c84590"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-204445255.json"}}],"schema_version":"1.7.5"}