{"id":"ASB-A-269456968","details":"In isValid of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-269456968","CVE-2026-58988"],"modified":"2026-11-02T16:56:22.198555469Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/hardware/interfaces","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/interfaces/+/54ed71c54672af6e1806d5cbc58ab8e38137c4ba","target":{"file":"neuralnetworks/aidl/vts/functional/ValidateModel.cpp"},"deprecated":false,"digest":{"line_hashes":["40592511717342990389942058539945609306","1215199241451092441693081628498869121","129948529691575016124142609218851295746","180984362077311833556099534600156618805","196474455315920770780076363565407616005","7710838437947647161968512562153547620","289101019889694858839139463180580597518"],"threshold":0.9},"id":"ASB-A-269456968-8ee0ac38","signature_type":"Line"},{"digest":{"length":840,"function_hash":"255834689267382053440549860468519338361"},"id":"ASB-A-269456968-baa82bfd","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/interfaces/+/54ed71c54672af6e1806d5cbc58ab8e38137c4ba","target":{"file":"neuralnetworks/aidl/vts/functional/ValidateModel.cpp","function":"validateModel"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/hardware/interfaces/+/54ed71c54672af6e1806d5cbc58ab8e38137c4ba"],"severity":"High","spl":"2026-11-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-269456968.json"}},{"package":{"name":"platform/packages/modules/NeuralNetworks","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"types":["ID"],"vanir_signatures":[{"id":"ASB-A-269456968-56a726db","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/3aedb5493147609aca83519618e7cf0bf33c2123","target":{"file":"shim_and_sl/ShimConverter.cpp","function":"isValid"},"deprecated":false,"digest":{"function_hash":"117549551585405145896197857986194020165","length":2040}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/3aedb5493147609aca83519618e7cf0bf33c2123","target":{"file":"shim_and_sl/ShimConverter.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["75187719208275870646090957093481890954","340131414929134843437663854480429539680","54001838752359329900919718142955712081","285250356260115474433082804678168617461","109424735767730076176734673742369407379","39573811633329355338794009495144039177","182830228131374686493677244538863397532","98379926951023035715857893892377015667","188637344271475611293398993770431629553","229387678612352843714756599500284039861","85359450305213975842027923137755667731","220001508687791037264125116951112954330","324735370805818494230502263013918886225","101085154751499475628652996322645265504","67375320668609752978282465410270834414","120552197073837783068915436307065730213","126287348359886453068673444172571704445","50757414922992344976773212318036965487"]},"id":"ASB-A-269456968-61aabd5f"}],"fixes":["https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/3aedb5493147609aca83519618e7cf0bf33c2123"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-269456968.json"}},{"package":{"name":"platform/hardware/interfaces","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"vanir_signatures":[{"target":{"file":"neuralnetworks/aidl/vts/functional/ValidateModel.cpp","function":"validateModel"},"deprecated":false,"digest":{"length":840,"function_hash":"255834689267382053440549860468519338361"},"id":"ASB-A-269456968-13286ff3","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/interfaces/+/f175a9842907a57cf98f238dbd64022dcb1acd4f"},{"target":{"file":"neuralnetworks/aidl/vts/functional/ValidateModel.cpp"},"deprecated":false,"digest":{"line_hashes":["40592511717342990389942058539945609306","1215199241451092441693081628498869121","129948529691575016124142609218851295746","180984362077311833556099534600156618805","196474455315920770780076363565407616005","7710838437947647161968512562153547620","289101019889694858839139463180580597518"],"threshold":0.9},"id":"ASB-A-269456968-48621dd5","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/interfaces/+/f175a9842907a57cf98f238dbd64022dcb1acd4f"}],"fixes":["https://android.googlesource.com/platform/hardware/interfaces/+/f175a9842907a57cf98f238dbd64022dcb1acd4f"],"severity":"High","spl":"2026-11-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-269456968.json"}},{"package":{"name":"platform/packages/modules/NeuralNetworks","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/b6fa7d7c01b682ca744a23762ce846427ad1135b","target":{"function":"isValid","file":"shim_and_sl/ShimConverter.cpp"},"deprecated":false,"digest":{"function_hash":"117549551585405145896197857986194020165","length":2040},"id":"ASB-A-269456968-b2779a72"},{"source":"https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/b6fa7d7c01b682ca744a23762ce846427ad1135b","target":{"file":"shim_and_sl/ShimConverter.cpp"},"deprecated":false,"digest":{"line_hashes":["75187719208275870646090957093481890954","340131414929134843437663854480429539680","54001838752359329900919718142955712081","285250356260115474433082804678168617461","109424735767730076176734673742369407379","39573811633329355338794009495144039177","182830228131374686493677244538863397532","98379926951023035715857893892377015667","188637344271475611293398993770431629553","229387678612352843714756599500284039861","85359450305213975842027923137755667731","220001508687791037264125116951112954330","324735370805818494230502263013918886225","101085154751499475628652996322645265504","67375320668609752978282465410270834414","120552197073837783068915436307065730213","126287348359886453068673444172571704445","50757414922992344976773212318036965487"],"threshold":0.9},"id":"ASB-A-269456968-b74e00fa","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/b6fa7d7c01b682ca744a23762ce846427ad1135b"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-269456968.json"}},{"package":{"name":"platform/hardware/interfaces","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/hardware/interfaces/+/780a671da3d030368345155adc97e1687f8658de","target":{"file":"neuralnetworks/aidl/vts/functional/ValidateModel.cpp","function":"validateModel"},"deprecated":false,"digest":{"function_hash":"255834689267382053440549860468519338361","length":840},"id":"ASB-A-269456968-117fc0ca","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/interfaces/+/780a671da3d030368345155adc97e1687f8658de","target":{"file":"neuralnetworks/aidl/vts/functional/ValidateModel.cpp"},"deprecated":false,"digest":{"line_hashes":["40592511717342990389942058539945609306","1215199241451092441693081628498869121","129948529691575016124142609218851295746","180984362077311833556099534600156618805","196474455315920770780076363565407616005","7710838437947647161968512562153547620","289101019889694858839139463180580597518"],"threshold":0.9},"id":"ASB-A-269456968-b75687c4"}],"fixes":["https://android.googlesource.com/platform/hardware/interfaces/+/780a671da3d030368345155adc97e1687f8658de"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-269456968.json"}},{"package":{"name":"platform/packages/modules/NeuralNetworks","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/2cd68475b487672290c44e7adaed5a8f76ef1957","target":{"file":"shim_and_sl/ShimConverter.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["75187719208275870646090957093481890954","340131414929134843437663854480429539680","54001838752359329900919718142955712081","285250356260115474433082804678168617461","109424735767730076176734673742369407379","39573811633329355338794009495144039177","182830228131374686493677244538863397532","98379926951023035715857893892377015667","188637344271475611293398993770431629553","229387678612352843714756599500284039861","85359450305213975842027923137755667731","220001508687791037264125116951112954330","324735370805818494230502263013918886225","101085154751499475628652996322645265504","67375320668609752978282465410270834414","120552197073837783068915436307065730213","126287348359886453068673444172571704445","50757414922992344976773212318036965487"]},"id":"ASB-A-269456968-00e7ab1e"},{"deprecated":false,"digest":{"function_hash":"117549551585405145896197857986194020165","length":2040},"id":"ASB-A-269456968-6540ee1d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/2cd68475b487672290c44e7adaed5a8f76ef1957","target":{"file":"shim_and_sl/ShimConverter.cpp","function":"isValid"}}],"fixes":["https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/2cd68475b487672290c44e7adaed5a8f76ef1957"],"severity":"High","spl":"2026-11-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-269456968.json"}},{"package":{"name":"platform/hardware/interfaces","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/hardware/interfaces/+/332a204885a17a96969b6cfba494f2463db574e0"],"severity":"High","spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"digest":{"line_hashes":["40592511717342990389942058539945609306","1215199241451092441693081628498869121","129948529691575016124142609218851295746","180984362077311833556099534600156618805","196474455315920770780076363565407616005","7710838437947647161968512562153547620","289101019889694858839139463180580597518"],"threshold":0.9},"id":"ASB-A-269456968-78c5da37","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/interfaces/+/332a204885a17a96969b6cfba494f2463db574e0","target":{"file":"neuralnetworks/aidl/vts/functional/ValidateModel.cpp"},"deprecated":false},{"source":"https://android.googlesource.com/platform/hardware/interfaces/+/332a204885a17a96969b6cfba494f2463db574e0","target":{"file":"neuralnetworks/aidl/vts/functional/ValidateModel.cpp","function":"validateModel"},"deprecated":false,"digest":{"length":840,"function_hash":"255834689267382053440549860468519338361"},"id":"ASB-A-269456968-b86a92c0","signature_type":"Function","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-269456968.json"}},{"package":{"name":"platform/packages/modules/NeuralNetworks","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/75e56c8ef4c213ccf72b12fbe076d125c5192865","target":{"function":"isValid","file":"shim_and_sl/ShimConverter.cpp"},"deprecated":false,"digest":{"length":2040,"function_hash":"117549551585405145896197857986194020165"},"id":"ASB-A-269456968-4b252925"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/75e56c8ef4c213ccf72b12fbe076d125c5192865","target":{"file":"shim_and_sl/ShimConverter.cpp"},"deprecated":false,"digest":{"line_hashes":["75187719208275870646090957093481890954","340131414929134843437663854480429539680","54001838752359329900919718142955712081","285250356260115474433082804678168617461","109424735767730076176734673742369407379","39573811633329355338794009495144039177","182830228131374686493677244538863397532","98379926951023035715857893892377015667","188637344271475611293398993770431629553","229387678612352843714756599500284039861","85359450305213975842027923137755667731","220001508687791037264125116951112954330","324735370805818494230502263013918886225","101085154751499475628652996322645265504","67375320668609752978282465410270834414","120552197073837783068915436307065730213","126287348359886453068673444172571704445","50757414922992344976773212318036965487"],"threshold":0.9},"id":"ASB-A-269456968-e973a787","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/75e56c8ef4c213ccf72b12fbe076d125c5192865"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-269456968.json"}},{"package":{"name":"platform/hardware/interfaces","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/hardware/interfaces/+/98d133b6182eab38f6af5c56bf1f9a00687ea277"],"severity":"High","spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["40592511717342990389942058539945609306","1215199241451092441693081628498869121","129948529691575016124142609218851295746","180984362077311833556099534600156618805","196474455315920770780076363565407616005","7710838437947647161968512562153547620","289101019889694858839139463180580597518"]},"id":"ASB-A-269456968-4b814d83","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/interfaces/+/98d133b6182eab38f6af5c56bf1f9a00687ea277","target":{"file":"neuralnetworks/aidl/vts/functional/ValidateModel.cpp"},"deprecated":false},{"source":"https://android.googlesource.com/platform/hardware/interfaces/+/98d133b6182eab38f6af5c56bf1f9a00687ea277","target":{"file":"neuralnetworks/aidl/vts/functional/ValidateModel.cpp","function":"validateModel"},"deprecated":false,"digest":{"function_hash":"255834689267382053440549860468519338361","length":840},"id":"ASB-A-269456968-86dcdde1","signature_type":"Function","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-269456968.json"}},{"package":{"name":"platform/packages/modules/NeuralNetworks","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/0be2d9a3abdc89d33e14b1fac965ce53b52b3f5a","target":{"file":"shim_and_sl/ShimConverter.cpp","function":"isValid"},"deprecated":false,"digest":{"length":2040,"function_hash":"117549551585405145896197857986194020165"},"id":"ASB-A-269456968-b591eb91","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/0be2d9a3abdc89d33e14b1fac965ce53b52b3f5a","target":{"file":"shim_and_sl/ShimConverter.cpp"},"deprecated":false,"digest":{"line_hashes":["75187719208275870646090957093481890954","340131414929134843437663854480429539680","54001838752359329900919718142955712081","285250356260115474433082804678168617461","109424735767730076176734673742369407379","39573811633329355338794009495144039177","182830228131374686493677244538863397532","98379926951023035715857893892377015667","188637344271475611293398993770431629553","229387678612352843714756599500284039861","85359450305213975842027923137755667731","220001508687791037264125116951112954330","324735370805818494230502263013918886225","101085154751499475628652996322645265504","67375320668609752978282465410270834414","120552197073837783068915436307065730213","126287348359886453068673444172571704445","50757414922992344976773212318036965487"],"threshold":0.9},"id":"ASB-A-269456968-f00ca319"}],"fixes":["https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/0be2d9a3abdc89d33e14b1fac965ce53b52b3f5a"],"severity":"High","spl":"2026-11-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-269456968.json"}},{"package":{"name":"platform/hardware/interfaces","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"vanir_signatures":[{"digest":{"function_hash":"255834689267382053440549860468519338361","length":840},"id":"ASB-A-269456968-c2885ffe","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/interfaces/+/15f2e6e195f8e674f7612eade4f0ac170ba0a896","target":{"file":"neuralnetworks/aidl/vts/functional/ValidateModel.cpp","function":"validateModel"},"deprecated":false},{"digest":{"line_hashes":["40592511717342990389942058539945609306","1215199241451092441693081628498869121","129948529691575016124142609218851295746","180984362077311833556099534600156618805","196474455315920770780076363565407616005","7710838437947647161968512562153547620","289101019889694858839139463180580597518"],"threshold":0.9},"id":"ASB-A-269456968-f55d7d92","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/interfaces/+/15f2e6e195f8e674f7612eade4f0ac170ba0a896","target":{"file":"neuralnetworks/aidl/vts/functional/ValidateModel.cpp"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/hardware/interfaces/+/15f2e6e195f8e674f7612eade4f0ac170ba0a896"],"severity":"High","spl":"2026-11-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-269456968.json"}},{"package":{"name":"platform/packages/modules/NeuralNetworks","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/3fc1c2b349b1cf6f20ccd017b8c18108237c150a"],"severity":"High","spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"target":{"file":"shim_and_sl/ShimConverter.cpp"},"deprecated":false,"digest":{"line_hashes":["75187719208275870646090957093481890954","340131414929134843437663854480429539680","54001838752359329900919718142955712081","285250356260115474433082804678168617461","109424735767730076176734673742369407379","39573811633329355338794009495144039177","182830228131374686493677244538863397532","98379926951023035715857893892377015667","188637344271475611293398993770431629553","229387678612352843714756599500284039861","85359450305213975842027923137755667731","220001508687791037264125116951112954330","324735370805818494230502263013918886225","101085154751499475628652996322645265504","67375320668609752978282465410270834414","120552197073837783068915436307065730213","126287348359886453068673444172571704445","50757414922992344976773212318036965487"],"threshold":0.9},"id":"ASB-A-269456968-5ac3dbaf","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/3fc1c2b349b1cf6f20ccd017b8c18108237c150a"},{"digest":{"length":2040,"function_hash":"117549551585405145896197857986194020165"},"id":"ASB-A-269456968-5bb6f55c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/3fc1c2b349b1cf6f20ccd017b8c18108237c150a","target":{"file":"shim_and_sl/ShimConverter.cpp","function":"isValid"},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-269456968.json"}}],"schema_version":"1.9.2"}