{"id":"ASB-A-356604577","details":"In getRingtone of RingtoneFactory.java, there is a possible unprivileged access risk due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-356604577","CVE-2026-28621"],"modified":"2026-11-02T17:11:16.892895434Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/packages/services/Telecomm","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/294327c63301a330c87efb79e741e4f505f78312","target":{"file":"src/com/android/server/telecom/Call.java"},"deprecated":false,"digest":{"line_hashes":["113976216836445985383589168636576178479","41283135156377240570101548926100466880","159778806540973070440312228125618727696","38568909214429048247959839473950790826"],"threshold":0.9},"id":"ASB-A-356604577-8749f240","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/294327c63301a330c87efb79e741e4f505f78312","target":{"file":"src/com/android/server/telecom/RingtoneFactory.java"},"deprecated":false,"digest":{"line_hashes":["61124084889651645756075522482970978806","131324571745533276400711737850610033290","184340636346078831982912569665948850228","251038086907942866930897090791675501008","164464618322118610936381152227601559020","148761371253026793947396279386510803113","150727748171029986373742904342704738540","1322793698115860113759040962462644032","66302996087778977184724244774888395407","81153556895043228420075202822034836507","74677701199552462174083364462205469758"],"threshold":0.9},"id":"ASB-A-356604577-b9d146f2"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/294327c63301a330c87efb79e741e4f505f78312","target":{"function":"getRingtone","file":"src/com/android/server/telecom/RingtoneFactory.java"},"deprecated":false,"digest":{"function_hash":"16566564100253720178355067189688353778","length":1436},"id":"ASB-A-356604577-c5c1d7e4"}],"fixes":["https://android.googlesource.com/platform/packages/services/Telecomm/+/294327c63301a330c87efb79e741e4f505f78312"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-356604577.json"}},{"package":{"name":"platform/packages/services/Telecomm","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/services/Telecomm/+/f2ef458fc4669e71069616d54fc5d39f50f5daf9"],"severity":"High","spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"digest":{"function_hash":"16566564100253720178355067189688353778","length":1436},"id":"ASB-A-356604577-3b1e1ee4","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/f2ef458fc4669e71069616d54fc5d39f50f5daf9","target":{"file":"src/com/android/server/telecom/RingtoneFactory.java","function":"getRingtone"},"deprecated":false},{"id":"ASB-A-356604577-bb221c15","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/f2ef458fc4669e71069616d54fc5d39f50f5daf9","target":{"file":"src/com/android/server/telecom/RingtoneFactory.java"},"deprecated":false,"digest":{"line_hashes":["61124084889651645756075522482970978806","131324571745533276400711737850610033290","184340636346078831982912569665948850228","251038086907942866930897090791675501008","164464618322118610936381152227601559020","148761371253026793947396279386510803113","150727748171029986373742904342704738540","1322793698115860113759040962462644032","66302996087778977184724244774888395407","81153556895043228420075202822034836507","74677701199552462174083364462205469758"],"threshold":0.9}},{"id":"ASB-A-356604577-d0351586","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/f2ef458fc4669e71069616d54fc5d39f50f5daf9","target":{"file":"src/com/android/server/telecom/Call.java"},"deprecated":false,"digest":{"line_hashes":["113976216836445985383589168636576178479","41283135156377240570101548926100466880","159778806540973070440312228125618727696","38568909214429048247959839473950790826"],"threshold":0.9}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-356604577.json"}},{"package":{"name":"platform/packages/services/Telecomm","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"types":["ID"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/81f00f98757e0de71d686e3651c6fa8540b254fd","target":{"file":"src/com/android/server/telecom/Call.java"},"deprecated":false,"digest":{"line_hashes":["113976216836445985383589168636576178479","41283135156377240570101548926100466880","159778806540973070440312228125618727696","38568909214429048247959839473950790826"],"threshold":0.9},"id":"ASB-A-356604577-0dd4babc"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/81f00f98757e0de71d686e3651c6fa8540b254fd","target":{"file":"src/com/android/server/telecom/RingtoneFactory.java"},"deprecated":false,"digest":{"line_hashes":["61124084889651645756075522482970978806","131324571745533276400711737850610033290","184340636346078831982912569665948850228","251038086907942866930897090791675501008","164464618322118610936381152227601559020","148761371253026793947396279386510803113","150727748171029986373742904342704738540","1322793698115860113759040962462644032","66302996087778977184724244774888395407","81153556895043228420075202822034836507","74677701199552462174083364462205469758"],"threshold":0.9},"id":"ASB-A-356604577-508ea479"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/81f00f98757e0de71d686e3651c6fa8540b254fd","target":{"file":"src/com/android/server/telecom/RingtoneFactory.java","function":"getRingtone"},"deprecated":false,"digest":{"function_hash":"16566564100253720178355067189688353778","length":1436},"id":"ASB-A-356604577-6d3e5630"}],"fixes":["https://android.googlesource.com/platform/packages/services/Telecomm/+/81f00f98757e0de71d686e3651c6fa8540b254fd"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-356604577.json"}},{"package":{"name":"platform/packages/services/Telecomm","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"target":{"file":"src/com/android/server/telecom/RingtoneFactory.java","function":"getRingtone"},"deprecated":false,"digest":{"function_hash":"72223936779122721738332034670374120105","length":1282},"id":"ASB-A-356604577-68e50248","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/166b1f970e0039f67ae7fb9a9d0ff0f09de60f30"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/166b1f970e0039f67ae7fb9a9d0ff0f09de60f30","target":{"file":"src/com/android/server/telecom/Call.java"},"deprecated":false,"digest":{"line_hashes":["113976216836445985383589168636576178479","41283135156377240570101548926100466880","159778806540973070440312228125618727696","38568909214429048247959839473950790826"],"threshold":0.9},"id":"ASB-A-356604577-72f98126","signature_type":"Line"},{"id":"ASB-A-356604577-e3955e9c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/166b1f970e0039f67ae7fb9a9d0ff0f09de60f30","target":{"file":"src/com/android/server/telecom/RingtoneFactory.java"},"deprecated":false,"digest":{"line_hashes":["61124084889651645756075522482970978806","131324571745533276400711737850610033290","184340636346078831982912569665948850228","251038086907942866930897090791675501008","164464618322118610936381152227601559020","148761371253026793947396279386510803113","150727748171029986373742904342704738540","1322793698115860113759040962462644032","38262275924217211793648488323911772105","139070617725050376901304850616928749865","74677701199552462174083364462205469758"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/packages/services/Telecomm/+/166b1f970e0039f67ae7fb9a9d0ff0f09de60f30"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-356604577.json"}}],"schema_version":"1.9.2"}