{"id":"ASB-A-379695596","details":"In onTransact of IDrmManagerService.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-379695596","CVE-2026-0010"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/358b3457706b53f63ea10e9905e953e2c9c37f31","target":{"file":"drm/common/IDrmManagerService.cpp","function":"BnDrmManagerService::onTransact"},"deprecated":false,"digest":{"function_hash":"254484530803293232433988124470089576972","length":18206},"id":"ASB-A-379695596-2da73c8a"},{"digest":{"threshold":0.9,"line_hashes":["193005296291010323106917966324247588790","294466828348999483103759003124382967705","87468087055771253729697964708624710120","64567366025305510261695894161190484659","275190152303307488874954423272887243061","114712313609923601026331383590958799121","219516882649605358681653722298635745789"]},"id":"ASB-A-379695596-df82e5a4","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/358b3457706b53f63ea10e9905e953e2c9c37f31","target":{"file":"drm/common/IDrmManagerService.cpp"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/358b3457706b53f63ea10e9905e953e2c9c37f31"],"severity":"High","spl":"2026-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-379695596.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"length":18206,"function_hash":"254484530803293232433988124470089576972"},"id":"ASB-A-379695596-933de1cd","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/7c5d19a1ae1f6762e2b52372a64d161fea6195fa","target":{"file":"drm/common/IDrmManagerService.cpp","function":"BnDrmManagerService::onTransact"}},{"digest":{"threshold":0.9,"line_hashes":["193005296291010323106917966324247588790","294466828348999483103759003124382967705","87468087055771253729697964708624710120","64567366025305510261695894161190484659","275190152303307488874954423272887243061","114712313609923601026331383590958799121","219516882649605358681653722298635745789"]},"id":"ASB-A-379695596-d4d47418","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/7c5d19a1ae1f6762e2b52372a64d161fea6195fa","target":{"file":"drm/common/IDrmManagerService.cpp"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/7c5d19a1ae1f6762e2b52372a64d161fea6195fa"],"severity":"High","spl":"2026-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-379695596.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/5dd95d00af9a58840fd842b75fc0876dc356d917","target":{"file":"drm/common/IDrmManagerService.cpp"},"deprecated":false,"digest":{"line_hashes":["193005296291010323106917966324247588790","294466828348999483103759003124382967705","87468087055771253729697964708624710120","64567366025305510261695894161190484659","275190152303307488874954423272887243061","114712313609923601026331383590958799121","219516882649605358681653722298635745789"],"threshold":0.9},"id":"ASB-A-379695596-5acd6e01"},{"deprecated":false,"digest":{"function_hash":"254484530803293232433988124470089576972","length":18206},"id":"ASB-A-379695596-de534b22","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/5dd95d00af9a58840fd842b75fc0876dc356d917","target":{"file":"drm/common/IDrmManagerService.cpp","function":"BnDrmManagerService::onTransact"}}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/5dd95d00af9a58840fd842b75fc0876dc356d917"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-379695596.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/3c28b8d07342652074e7b7fe804f7ca1dea5dd14","target":{"file":"drm/common/IDrmManagerService.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["193005296291010323106917966324247588790","294466828348999483103759003124382967705","87468087055771253729697964708624710120","64567366025305510261695894161190484659","275190152303307488874954423272887243061","114712313609923601026331383590958799121","219516882649605358681653722298635745789"]},"id":"ASB-A-379695596-34dd0182"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/3c28b8d07342652074e7b7fe804f7ca1dea5dd14","target":{"function":"BnDrmManagerService::onTransact","file":"drm/common/IDrmManagerService.cpp"},"deprecated":false,"digest":{"function_hash":"254484530803293232433988124470089576972","length":18206},"id":"ASB-A-379695596-c761b811"}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/3c28b8d07342652074e7b7fe804f7ca1dea5dd14"],"severity":"High","spl":"2026-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-379695596.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-09-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-379695596-16b20d5f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/8e588440e4b5bc982e6906b547c204a7d4282c16","target":{"file":"drm/common/IDrmManagerService.cpp"},"deprecated":false,"digest":{"line_hashes":["193005296291010323106917966324247588790","294466828348999483103759003124382967705","87468087055771253729697964708624710120","64567366025305510261695894161190484659","275190152303307488874954423272887243061","114712313609923601026331383590958799121","219516882649605358681653722298635745789"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/8e588440e4b5bc982e6906b547c204a7d4282c16","target":{"file":"drm/common/IDrmManagerService.cpp","function":"BnDrmManagerService::onTransact"},"deprecated":false,"digest":{"function_hash":"150644367776923948850731846212645917637","length":18209},"id":"ASB-A-379695596-a1ab5b03"}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/8e588440e4b5bc982e6906b547c204a7d4282c16"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-379695596.json"}}],"schema_version":"1.9.0"}