{"id":"ASB-A-309407957","details":"In writeToParcel of CursorWindow.cpp, there is a possible out of bounds read due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-309407957","CVE-2025-26448"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-06-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/3c1515f4d1942f2453554315a576ed874703f78b"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-next:0"},{"fixed":"16-next:2025-06-01"}]}],"versions":["16-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/9dc64621d896d05fcb0e6f45792a307fde130823"],"severity":"High","spl":"2025-06-01","types":["ID"],"vanir_signatures":[{"digest":{"function_hash":"254295238308086076035495037435727539914","length":539},"id":"ASB-A-309407957-21a5757e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/9dc64621d896d05fcb0e6f45792a307fde130823","target":{"function":"CursorWindow::create","file":"libs/androidfw/CursorWindow.cpp"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/9dc64621d896d05fcb0e6f45792a307fde130823","target":{"file":"libs/androidfw/CursorWindow.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["26873316175401722726514673650709571911","300215652726136324139284894927596639103","47606514160011987552360396234732153973","167876416654811209050624263343396057121"]},"id":"ASB-A-309407957-e5a135d2","signature_type":"Line"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-309407957.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-06-01"}]}],"versions":["15"],"ecosystem_specific":{"severity":"High","spl":"2025-06-01","types":["ID"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/ae4b644a7cfb66f1e51ade508f115aec63bc16ef","target":{"file":"libs/androidfw/CursorWindow.cpp"},"deprecated":false,"digest":{"line_hashes":["26873316175401722726514673650709571911","300215652726136324139284894927596639103","47606514160011987552360396234732153973","167876416654811209050624263343396057121"],"threshold":0.9},"id":"ASB-A-309407957-10158c9d","signature_type":"Line","signature_version":"v1"},{"target":{"function":"CursorWindow::create","file":"libs/androidfw/CursorWindow.cpp"},"deprecated":false,"digest":{"function_hash":"254295238308086076035495037435727539914","length":539},"id":"ASB-A-309407957-1cac09cf","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ae4b644a7cfb66f1e51ade508f115aec63bc16ef"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/ae4b644a7cfb66f1e51ade508f115aec63bc16ef"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-309407957.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-06-01"}]}],"versions":["13"],"ecosystem_specific":{"types":["ID"],"vanir_signatures":[{"id":"ASB-A-309407957-4361cfde","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5b26a62b4d813b8ccc1de81641e87c9e95c8d958","target":{"file":"libs/androidfw/CursorWindow.cpp","function":"CursorWindow::create"},"deprecated":false,"digest":{"length":539,"function_hash":"254295238308086076035495037435727539914"}},{"digest":{"line_hashes":["26873316175401722726514673650709571911","300215652726136324139284894927596639103","47606514160011987552360396234732153973","167876416654811209050624263343396057121"],"threshold":0.9},"id":"ASB-A-309407957-ed2703fc","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5b26a62b4d813b8ccc1de81641e87c9e95c8d958","target":{"file":"libs/androidfw/CursorWindow.cpp"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/5b26a62b4d813b8ccc1de81641e87c9e95c8d958"],"severity":"High","spl":"2025-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-309407957.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-06-01"}]}],"versions":["14"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/c07e0eba29ee1f92b4d540f07a05b8e306601613"],"severity":"High","spl":"2025-06-01","types":["ID"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/c07e0eba29ee1f92b4d540f07a05b8e306601613","target":{"file":"libs/androidfw/CursorWindow.cpp"},"deprecated":false,"digest":{"line_hashes":["26873316175401722726514673650709571911","300215652726136324139284894927596639103","47606514160011987552360396234732153973","167876416654811209050624263343396057121"],"threshold":0.9},"id":"ASB-A-309407957-df957ada","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c07e0eba29ee1f92b4d540f07a05b8e306601613","target":{"function":"CursorWindow::create","file":"libs/androidfw/CursorWindow.cpp"},"deprecated":false,"digest":{"length":539,"function_hash":"254295238308086076035495037435727539914"},"id":"ASB-A-309407957-e80897c8"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-309407957.json"}}],"schema_version":"1.9.0"}