{"id":"ASB-A-395640294","details":"In updateInternal of MediaProvider.java, there is a possible expose contents of files due to a race condition. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-395640294","CVE-2026-28671"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/87beb3978b6a5182bcf9f6515a55f44dd7a5c40b"}],"affected":[{"package":{"name":"platform/packages/providers/MediaProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/ee2699b7bd609033104d7af81f645a8651667ea7"],"severity":"High","spl":"2026-09-01","types":["ID"],"vanir_signatures":[{"id":"ASB-A-395640294-044c2cae","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/ee2699b7bd609033104d7af81f645a8651667ea7","target":{"file":"src/com/android/providers/media/MediaProvider.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["107722282517698684767477409643759250544","106195599690190099700365045785634353987","34343465402187941265189485859226842533","187562420612320604045735771178140777170","108583239104961179031578237648835062254","278051027582979793816776558647033161371","198777039263850969928641598920758265679","99642844379536817704468101248977985012","303879615761766548400783519183361575017","21123919559391001778328564115499610192","212629803622068668223499256570494790152","114070009689164164728737572243092922480","214741686423153585623367148764063300641","61791770723973464173059458612669088558","30390683799556783338260379283735233096","299894602562069635979049739633768715778","251000686604326104426892742388881901928","264418257606624705966641622794773820458","138645820822728473920703017772966792841","281770174100456264046783957404908129595","121798250708005534186516951135888228592","117748187101165184835814433263487252462","313373230753693311030864694362098810403","92889964142825625614117259280159807479","331936361490480482101602390023912788792","159242233644873961846250070030736945265","251474751339522115646900772346664423842","200816344727213662502614139320814670092","312120460102781594930268578640475129722","58225564245825185984762348107386658170"]}},{"id":"ASB-A-395640294-d56df531","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/ee2699b7bd609033104d7af81f645a8651667ea7","target":{"file":"src/com/android/providers/media/MediaProvider.java","function":"updateInternal"},"deprecated":false,"digest":{"length":12098,"function_hash":"272987275707577863687160704049901867880"}},{"id":"ASB-A-395640294-e66d1d3d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/ee2699b7bd609033104d7af81f645a8651667ea7","target":{"file":"src/com/android/providers/media/MediaProvider.java","function":"updateAllowingReplace"},"deprecated":false,"digest":{"function_hash":"15759488976106664736020505197193513080","length":1213}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-395640294.json"}},{"package":{"name":"platform/packages/providers/MediaProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/b506e94013f7690a6a6fa391164ff6f0588c8c17"],"severity":"High","spl":"2026-09-01","types":["ID"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/b506e94013f7690a6a6fa391164ff6f0588c8c17","target":{"file":"src/com/android/providers/media/MediaProvider.java"},"deprecated":false,"digest":{"line_hashes":["107722282517698684767477409643759250544","106195599690190099700365045785634353987","34343465402187941265189485859226842533","187562420612320604045735771178140777170","145307975397132922448455774074906991819","73410774982488417792036455915648212011","150309982826202957516420894645411138653","111774179024329579174817963615180773982","205812661923820651384652059740441444834","21123919559391001778328564115499610192","212629803622068668223499256570494790152","114070009689164164728737572243092922480","214741686423153585623367148764063300641","61791770723973464173059458612669088558","30390683799556783338260379283735233096","299894602562069635979049739633768715778","251000686604326104426892742388881901928","264418257606624705966641622794773820458","138645820822728473920703017772966792841","281770174100456264046783957404908129595","121798250708005534186516951135888228592","117748187101165184835814433263487252462","313373230753693311030864694362098810403","92889964142825625614117259280159807479","331936361490480482101602390023912788792","159242233644873961846250070030736945265","251474751339522115646900772346664423842","200816344727213662502614139320814670092","312120460102781594930268578640475129722","58225564245825185984762348107386658170"],"threshold":0.9},"id":"ASB-A-395640294-2a347e99"},{"target":{"file":"src/com/android/providers/media/MediaProvider.java","function":"updateInternal"},"deprecated":false,"digest":{"length":11675,"function_hash":"257973483470276085673613464415177300004"},"id":"ASB-A-395640294-c4aa05bf","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/b506e94013f7690a6a6fa391164ff6f0588c8c17"},{"target":{"file":"src/com/android/providers/media/MediaProvider.java","function":"updateAllowingReplace"},"deprecated":false,"digest":{"function_hash":"15759488976106664736020505197193513080","length":1213},"id":"ASB-A-395640294-e9d46e86","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/b506e94013f7690a6a6fa391164ff6f0588c8c17"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-395640294.json"}},{"package":{"name":"platform/packages/providers/MediaProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"spl":"2026-09-01","types":["ID"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/547496f54f37a0902efb391ba8e1e7ff3939dd7e","target":{"file":"src/com/android/providers/media/MediaProvider.java","function":"updateInternal"},"deprecated":false,"digest":{"length":11975,"function_hash":"236313815813307590723936323514559790018"},"id":"ASB-A-395640294-19bb31e0","signature_type":"Function","signature_version":"v1"},{"target":{"file":"src/com/android/providers/media/MediaProvider.java"},"deprecated":false,"digest":{"line_hashes":["107722282517698684767477409643759250544","106195599690190099700365045785634353987","34343465402187941265189485859226842533","187562420612320604045735771178140777170","145307975397132922448455774074906991819","73410774982488417792036455915648212011","150309982826202957516420894645411138653","111774179024329579174817963615180773982","205812661923820651384652059740441444834","21123919559391001778328564115499610192","212629803622068668223499256570494790152","114070009689164164728737572243092922480","214741686423153585623367148764063300641","61791770723973464173059458612669088558","30390683799556783338260379283735233096","299894602562069635979049739633768715778","251000686604326104426892742388881901928","264418257606624705966641622794773820458","138645820822728473920703017772966792841","281770174100456264046783957404908129595","121798250708005534186516951135888228592","117748187101165184835814433263487252462","313373230753693311030864694362098810403","92889964142825625614117259280159807479","331936361490480482101602390023912788792","159242233644873961846250070030736945265","251474751339522115646900772346664423842","200816344727213662502614139320814670092","312120460102781594930268578640475129722","58225564245825185984762348107386658170"],"threshold":0.9},"id":"ASB-A-395640294-1f636914","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/547496f54f37a0902efb391ba8e1e7ff3939dd7e"},{"id":"ASB-A-395640294-21d1c303","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/547496f54f37a0902efb391ba8e1e7ff3939dd7e","target":{"function":"updateAllowingReplace","file":"src/com/android/providers/media/MediaProvider.java"},"deprecated":false,"digest":{"function_hash":"15759488976106664736020505197193513080","length":1213}}],"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/547496f54f37a0902efb391ba8e1e7ff3939dd7e"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-395640294.json"}},{"package":{"name":"platform/packages/providers/MediaProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"spl":"2026-09-01","types":["ID"],"vanir_signatures":[{"digest":{"length":12000,"function_hash":"245998050471096265882091166730181455331"},"id":"ASB-A-395640294-0f07376e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/e24b3d2a44d6e4adbca214e759fcab56b457a2cc","target":{"file":"src/com/android/providers/media/MediaProvider.java","function":"updateInternal"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["107722282517698684767477409643759250544","106195599690190099700365045785634353987","34343465402187941265189485859226842533","187562420612320604045735771178140777170","108583239104961179031578237648835062254","278051027582979793816776558647033161371","198777039263850969928641598920758265679","99642844379536817704468101248977985012","278928533785162506153207497226126011945","21123919559391001778328564115499610192","212629803622068668223499256570494790152","114070009689164164728737572243092922480","214741686423153585623367148764063300641","61791770723973464173059458612669088558","30390683799556783338260379283735233096","299894602562069635979049739633768715778","251000686604326104426892742388881901928","264418257606624705966641622794773820458","138645820822728473920703017772966792841","281770174100456264046783957404908129595","121798250708005534186516951135888228592","117748187101165184835814433263487252462","313373230753693311030864694362098810403","92889964142825625614117259280159807479","331936361490480482101602390023912788792","159242233644873961846250070030736945265","251474751339522115646900772346664423842","200816344727213662502614139320814670092","312120460102781594930268578640475129722","58225564245825185984762348107386658170"],"threshold":0.9},"id":"ASB-A-395640294-46a6a51b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/e24b3d2a44d6e4adbca214e759fcab56b457a2cc","target":{"file":"src/com/android/providers/media/MediaProvider.java"}},{"id":"ASB-A-395640294-85290405","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/e24b3d2a44d6e4adbca214e759fcab56b457a2cc","target":{"function":"updateAllowingReplace","file":"src/com/android/providers/media/MediaProvider.java"},"deprecated":false,"digest":{"length":1213,"function_hash":"15759488976106664736020505197193513080"}}],"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/e24b3d2a44d6e4adbca214e759fcab56b457a2cc"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-395640294.json"}},{"package":{"name":"platform/packages/providers/MediaProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/cfb1be8a47103e0178c8e7d7e2c329e03320493e"],"severity":"High","spl":"2026-09-01","types":["ID"],"vanir_signatures":[{"digest":{"function_hash":"245998050471096265882091166730181455331","length":12000},"id":"ASB-A-395640294-1dafc5b2","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/cfb1be8a47103e0178c8e7d7e2c329e03320493e","target":{"function":"updateInternal","file":"src/com/android/providers/media/MediaProvider.java"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/cfb1be8a47103e0178c8e7d7e2c329e03320493e","target":{"file":"src/com/android/providers/media/MediaProvider.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["107722282517698684767477409643759250544","106195599690190099700365045785634353987","34343465402187941265189485859226842533","187562420612320604045735771178140777170","108583239104961179031578237648835062254","278051027582979793816776558647033161371","198777039263850969928641598920758265679","99642844379536817704468101248977985012","303879615761766548400783519183361575017","21123919559391001778328564115499610192","212629803622068668223499256570494790152","114070009689164164728737572243092922480","214741686423153585623367148764063300641","61791770723973464173059458612669088558","30390683799556783338260379283735233096","299894602562069635979049739633768715778","251000686604326104426892742388881901928","264418257606624705966641622794773820458","138645820822728473920703017772966792841","281770174100456264046783957404908129595","121798250708005534186516951135888228592","117748187101165184835814433263487252462","313373230753693311030864694362098810403","92889964142825625614117259280159807479","331936361490480482101602390023912788792","159242233644873961846250070030736945265","251474751339522115646900772346664423842","200816344727213662502614139320814670092","312120460102781594930268578640475129722","58225564245825185984762348107386658170"]},"id":"ASB-A-395640294-67b79a83","signature_type":"Line"},{"target":{"file":"src/com/android/providers/media/MediaProvider.java","function":"updateAllowingReplace"},"deprecated":false,"digest":{"function_hash":"15759488976106664736020505197193513080","length":1213},"id":"ASB-A-395640294-c4fd9922","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/cfb1be8a47103e0178c8e7d7e2c329e03320493e"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-395640294.json"}},{"package":{"name":"platform/packages/providers/MediaProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-09-01"}]}],"versions":["14"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/99ef959b7c4efc1cf837a16458a90728a3ce1e6b"],"severity":"High","spl":"2026-09-01","types":["ID"],"vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["107722282517698684767477409643759250544","106195599690190099700365045785634353987","34343465402187941265189485859226842533","187562420612320604045735771178140777170","145307975397132922448455774074906991819","73410774982488417792036455915648212011","150309982826202957516420894645411138653","111774179024329579174817963615180773982","205812661923820651384652059740441444834","21123919559391001778328564115499610192","212629803622068668223499256570494790152","114070009689164164728737572243092922480","214741686423153585623367148764063300641","61791770723973464173059458612669088558","30390683799556783338260379283735233096","299894602562069635979049739633768715778","251000686604326104426892742388881901928","264418257606624705966641622794773820458","138645820822728473920703017772966792841","281770174100456264046783957404908129595","121798250708005534186516951135888228592","117748187101165184835814433263487252462","313373230753693311030864694362098810403","92889964142825625614117259280159807479","331936361490480482101602390023912788792","159242233644873961846250070030736945265","251474751339522115646900772346664423842","200816344727213662502614139320814670092","312120460102781594930268578640475129722","58225564245825185984762348107386658170"]},"id":"ASB-A-395640294-2ef75ad1","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/99ef959b7c4efc1cf837a16458a90728a3ce1e6b","target":{"file":"src/com/android/providers/media/MediaProvider.java"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/99ef959b7c4efc1cf837a16458a90728a3ce1e6b","target":{"file":"src/com/android/providers/media/MediaProvider.java","function":"updateInternal"},"deprecated":false,"digest":{"function_hash":"336304510843888072003995720212888765640","length":11736},"id":"ASB-A-395640294-7621c03d","signature_type":"Function"},{"deprecated":false,"digest":{"length":1213,"function_hash":"15759488976106664736020505197193513080"},"id":"ASB-A-395640294-916ce7db","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/99ef959b7c4efc1cf837a16458a90728a3ce1e6b","target":{"function":"updateAllowingReplace","file":"src/com/android/providers/media/MediaProvider.java"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-395640294.json"}}],"schema_version":"1.9.0"}