{"id":"ASB-A-326211886","details":"In isRedactionNeededForOpenViaContentResolver of MediaProvider.java, there is a possible way to reveal the location of media due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-326211886","CVE-2026-0024"],"modified":"2026-09-21T16:00:45.521740994Z","published":"2026-03-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-03-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/69a25763cdb46c8f23fe9eb976132acbe2af82d6"}],"affected":[{"package":{"name":"platform/packages/providers/MediaProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2-next:0"},{"fixed":"16-qpr2-next:2026-03-01"}]}],"versions":["16-qpr2-next"],"ecosystem_specific":{"spl":"2026-03-01","types":["ID"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"3947879338536374300193749368928913597","length":293},"id":"ASB-A-326211886-04415335","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/5a11ea74803e7bbe1290f37f22dac14b92c37186","target":{"file":"src/com/android/providers/media/MediaProvider.java","function":"isRedactionNeededForOpenViaContentResolver"}},{"id":"ASB-A-326211886-1db770d1","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/5a11ea74803e7bbe1290f37f22dac14b92c37186","target":{"file":"src/com/android/providers/media/MediaProvider.java"},"deprecated":false,"digest":{"line_hashes":["11942720536607617696703649065436243496","170364309099591840265831493252690026462","306417887722100167761222320659362297824","280515532697186378497862985673960395489","186911562886917436077106131631727385089","33202830951727541712943087592435810376","242810567114659136805036914614495714887","74943360723542005165109766887749548476","248353977370790246216347256552783927922","220840218187834712177030544585848842281","110343117931918513917208193213497103904"],"threshold":0.9}},{"source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/5a11ea74803e7bbe1290f37f22dac14b92c37186","target":{"function":"openFileAndEnforcePathPermissionsHelper","file":"src/com/android/providers/media/MediaProvider.java"},"deprecated":false,"digest":{"length":3427,"function_hash":"43840274065816339079016027784976702125"},"id":"ASB-A-326211886-2b9d4415","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/5a11ea74803e7bbe1290f37f22dac14b92c37186"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-326211886.json"}},{"package":{"name":"platform/packages/providers/MediaProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-03-01"}]}],"versions":["15"],"ecosystem_specific":{"spl":"2026-03-01","types":["ID"],"vanir_signatures":[{"digest":{"function_hash":"115549677857835416436120192053471390438","length":3434},"id":"ASB-A-326211886-2987c307","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/c8a1e15d3a79c4b27406c22f6036ff66a35fe41e","target":{"file":"src/com/android/providers/media/MediaProvider.java","function":"openFileAndEnforcePathPermissionsHelper"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/c8a1e15d3a79c4b27406c22f6036ff66a35fe41e","target":{"function":"isRedactionNeededForOpenViaContentResolver","file":"src/com/android/providers/media/MediaProvider.java"},"deprecated":false,"digest":{"length":293,"function_hash":"3947879338536374300193749368928913597"},"id":"ASB-A-326211886-3123262e","signature_type":"Function"},{"target":{"file":"src/com/android/providers/media/MediaProvider.java"},"deprecated":false,"digest":{"line_hashes":["11942720536607617696703649065436243496","170364309099591840265831493252690026462","306417887722100167761222320659362297824","280515532697186378497862985673960395489","186911562886917436077106131631727385089","33202830951727541712943087592435810376","242810567114659136805036914614495714887","74943360723542005165109766887749548476","248353977370790246216347256552783927922","220840218187834712177030544585848842281","110343117931918513917208193213497103904"],"threshold":0.9},"id":"ASB-A-326211886-bcd8f7f5","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/c8a1e15d3a79c4b27406c22f6036ff66a35fe41e"}],"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/c8a1e15d3a79c4b27406c22f6036ff66a35fe41e"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-326211886.json"}},{"package":{"name":"platform/packages/providers/MediaProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-03-01"}]}],"versions":["16"],"ecosystem_specific":{"spl":"2026-03-01","types":["ID"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/e5e47f93838e1e9a3a3a520f7c89229fc041a8c3","target":{"file":"src/com/android/providers/media/MediaProvider.java","function":"isRedactionNeededForOpenViaContentResolver"},"deprecated":false,"digest":{"length":293,"function_hash":"3947879338536374300193749368928913597"},"id":"ASB-A-326211886-3f04b5af","signature_type":"Function"},{"id":"ASB-A-326211886-acde155e","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/e5e47f93838e1e9a3a3a520f7c89229fc041a8c3","target":{"file":"src/com/android/providers/media/MediaProvider.java"},"deprecated":false,"digest":{"line_hashes":["11942720536607617696703649065436243496","170364309099591840265831493252690026462","306417887722100167761222320659362297824","280515532697186378497862985673960395489","186911562886917436077106131631727385089","33202830951727541712943087592435810376","242810567114659136805036914614495714887","74943360723542005165109766887749548476","248353977370790246216347256552783927922","220840218187834712177030544585848842281","110343117931918513917208193213497103904"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/e5e47f93838e1e9a3a3a520f7c89229fc041a8c3","target":{"function":"openFileAndEnforcePathPermissionsHelper","file":"src/com/android/providers/media/MediaProvider.java"},"deprecated":false,"digest":{"length":3434,"function_hash":"115549677857835416436120192053471390438"},"id":"ASB-A-326211886-d22a412f"}],"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/e5e47f93838e1e9a3a3a520f7c89229fc041a8c3"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-326211886.json"}},{"package":{"name":"platform/packages/providers/MediaProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-03-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"types":["ID"],"vanir_signatures":[{"target":{"function":"openFileAndEnforcePathPermissionsHelper","file":"src/com/android/providers/media/MediaProvider.java"},"deprecated":false,"digest":{"function_hash":"43840274065816339079016027784976702125","length":3427},"id":"ASB-A-326211886-124e7bb7","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/fcbf16bed2dafccc1194b3cd40ef580feb3b35ca"},{"deprecated":false,"digest":{"function_hash":"3947879338536374300193749368928913597","length":293},"id":"ASB-A-326211886-30df316b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/fcbf16bed2dafccc1194b3cd40ef580feb3b35ca","target":{"function":"isRedactionNeededForOpenViaContentResolver","file":"src/com/android/providers/media/MediaProvider.java"}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["11942720536607617696703649065436243496","170364309099591840265831493252690026462","306417887722100167761222320659362297824","280515532697186378497862985673960395489","186911562886917436077106131631727385089","33202830951727541712943087592435810376","242810567114659136805036914614495714887","74943360723542005165109766887749548476","248353977370790246216347256552783927922","220840218187834712177030544585848842281","110343117931918513917208193213497103904"]},"id":"ASB-A-326211886-43bc7338","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/fcbf16bed2dafccc1194b3cd40ef580feb3b35ca","target":{"file":"src/com/android/providers/media/MediaProvider.java"}}],"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/fcbf16bed2dafccc1194b3cd40ef580feb3b35ca"],"severity":"High","spl":"2026-03-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-326211886.json"}},{"package":{"name":"platform/packages/providers/MediaProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-03-01"}]}],"versions":["14"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/e34c1886848b535b0ea643becfb559dc602de1b3"],"severity":"High","spl":"2026-03-01","types":["ID"],"vanir_signatures":[{"target":{"file":"src/com/android/providers/media/MediaProvider.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["11942720536607617696703649065436243496","194555235230629271095418792663574329333","313729190405648049158555111332899287996","147166000092093614102377397860580901220","186911562886917436077106131631727385089","33202830951727541712943087592435810376","242810567114659136805036914614495714887","74943360723542005165109766887749548476","248353977370790246216347256552783927922","220840218187834712177030544585848842281","110343117931918513917208193213497103904"]},"id":"ASB-A-326211886-288a0169","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/e34c1886848b535b0ea643becfb559dc602de1b3"},{"deprecated":false,"digest":{"length":3492,"function_hash":"218328680359319676980633498897235024463"},"id":"ASB-A-326211886-5a524704","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/e34c1886848b535b0ea643becfb559dc602de1b3","target":{"file":"src/com/android/providers/media/MediaProvider.java","function":"openFileAndEnforcePathPermissionsHelper"}},{"source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/e34c1886848b535b0ea643becfb559dc602de1b3","target":{"file":"src/com/android/providers/media/MediaProvider.java","function":"isRedactionNeededForOpenViaContentResolver"},"deprecated":false,"digest":{"function_hash":"3947879338536374300193749368928913597","length":293},"id":"ASB-A-326211886-7d328190","signature_type":"Function","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-326211886.json"}}],"schema_version":"1.9.0"}