{"id":"ASB-A-429417238","details":"In parseKnownActivityEmbeddingCerts of ParsingUtils.java, there is a possible permanent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-429417238","CVE-2026-58817"],"modified":"2026-11-02T16:56:22.403515821Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"types":["DoS"],"vanir_signatures":[{"digest":{"line_hashes":["306136529359641075513368964209708263678","123507770211255993651813289831972339760","3655616931828042997627322190628965527","332909460807459735099002142028160808396","304227493300646502449332491813484550862","245570317473973978117202907087829441441","196763123319378797482176461983037514634","256312972263055212677532211445382668670","337253228926897386829257334302070166490","300890432004437832092040560689949481155","50963977145015276314728445967738950406","122669960936708869006114982608557048832","328763088250435422836999130712035413696","211739489076725607812476063490105667765","141638703454890326429067496788754470760","199966837548834435407804437204200762881","261490629404462201185508042179370375761","16404223645792029503600092442635320744","18278861375283832920611302783856081532","171599445485654572934562279883326190152","46015860123260994606990546628713483162","199419217534886744147096603441495711791","5490366294424843882188422480510760522","159907339341954119328867857229328390729","266379167305941128299752562200156997543","163939404589066666541419238162041259706","190893879977609539443913433348050829268","88317630091678782345700262663917075208","23692016544369406808673701492767289018","196348174667685681635848625785139481334","53350124709609136729466963933136363528","42243062627570949681318621884620636737","125485040162517445626606605765657966748","113016388921423937688974813141830670998"],"threshold":0.9},"id":"ASB-A-429417238-23b4df75","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/9b87ad723646792a57b05e28931a788f372a2ec5","target":{"file":"core/java/com/android/internal/pm/pkg/parsing/ParsingUtils.java"},"deprecated":false},{"target":{"function":"parseKnownActivityEmbeddingCerts","file":"core/java/com/android/internal/pm/pkg/parsing/ParsingUtils.java"},"deprecated":false,"digest":{"function_hash":"247746600246818536682223738846478141763","length":1022},"id":"ASB-A-429417238-4f662d10","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/9b87ad723646792a57b05e28931a788f372a2ec5"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/9b87ad723646792a57b05e28931a788f372a2ec5"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-429417238.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["DoS"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0c38a57964f3f56389c4f2fefc7e8f037ab8303b","target":{"file":"core/java/com/android/internal/pm/pkg/parsing/ParsingUtils.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["306136529359641075513368964209708263678","123507770211255993651813289831972339760","3655616931828042997627322190628965527","332909460807459735099002142028160808396","304227493300646502449332491813484550862","245570317473973978117202907087829441441","196763123319378797482176461983037514634","256312972263055212677532211445382668670","337253228926897386829257334302070166490","300890432004437832092040560689949481155","50963977145015276314728445967738950406","122669960936708869006114982608557048832","328763088250435422836999130712035413696","211739489076725607812476063490105667765","141638703454890326429067496788754470760","199966837548834435407804437204200762881","261490629404462201185508042179370375761","16404223645792029503600092442635320744","18278861375283832920611302783856081532","171599445485654572934562279883326190152","46015860123260994606990546628713483162","199419217534886744147096603441495711791","5490366294424843882188422480510760522","159907339341954119328867857229328390729","266379167305941128299752562200156997543","163939404589066666541419238162041259706","190893879977609539443913433348050829268","88317630091678782345700262663917075208","23692016544369406808673701492767289018","196348174667685681635848625785139481334","53350124709609136729466963933136363528","42243062627570949681318621884620636737","125485040162517445626606605765657966748","113016388921423937688974813141830670998"]},"id":"ASB-A-429417238-393f4d37"},{"target":{"file":"core/java/com/android/internal/pm/pkg/parsing/ParsingUtils.java","function":"parseKnownActivityEmbeddingCerts"},"deprecated":false,"digest":{"function_hash":"247746600246818536682223738846478141763","length":1022},"id":"ASB-A-429417238-bc2e1dea","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0c38a57964f3f56389c4f2fefc7e8f037ab8303b"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/0c38a57964f3f56389c4f2fefc7e8f037ab8303b"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-429417238.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"id":"ASB-A-429417238-962a97ee","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/dbb4c3759121b1dbdd4ee9eb6cfe09b50a1b2f11","target":{"file":"core/java/com/android/internal/pm/pkg/parsing/ParsingUtils.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["306136529359641075513368964209708263678","123507770211255993651813289831972339760","3655616931828042997627322190628965527","332909460807459735099002142028160808396","304227493300646502449332491813484550862","245570317473973978117202907087829441441","196763123319378797482176461983037514634","256312972263055212677532211445382668670","337253228926897386829257334302070166490","300890432004437832092040560689949481155","50963977145015276314728445967738950406","122669960936708869006114982608557048832","328763088250435422836999130712035413696","211739489076725607812476063490105667765","141638703454890326429067496788754470760","199966837548834435407804437204200762881","261490629404462201185508042179370375761","16404223645792029503600092442635320744","18278861375283832920611302783856081532","171599445485654572934562279883326190152","46015860123260994606990546628713483162","199419217534886744147096603441495711791","5490366294424843882188422480510760522","159907339341954119328867857229328390729","266379167305941128299752562200156997543","163939404589066666541419238162041259706","190893879977609539443913433348050829268","88317630091678782345700262663917075208","23692016544369406808673701492767289018","196348174667685681635848625785139481334","53350124709609136729466963933136363528","42243062627570949681318621884620636737","125485040162517445626606605765657966748","113016388921423937688974813141830670998"]}},{"digest":{"function_hash":"247746600246818536682223738846478141763","length":1022},"id":"ASB-A-429417238-afa4cdc8","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/dbb4c3759121b1dbdd4ee9eb6cfe09b50a1b2f11","target":{"file":"core/java/com/android/internal/pm/pkg/parsing/ParsingUtils.java","function":"parseKnownActivityEmbeddingCerts"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/dbb4c3759121b1dbdd4ee9eb6cfe09b50a1b2f11"],"severity":"High","spl":"2026-11-01","types":["DoS"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-429417238.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"vanir_signatures":[{"id":"ASB-A-429417238-56522b5c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/58e6711dd5df6aa4d6da7f1e5de2f75cf10475f0","target":{"file":"core/java/com/android/internal/pm/pkg/parsing/ParsingUtils.java"},"deprecated":false,"digest":{"line_hashes":["306136529359641075513368964209708263678","123507770211255993651813289831972339760","3655616931828042997627322190628965527","332909460807459735099002142028160808396","304227493300646502449332491813484550862","245570317473973978117202907087829441441","196763123319378797482176461983037514634","256312972263055212677532211445382668670","337253228926897386829257334302070166490","300890432004437832092040560689949481155","50963977145015276314728445967738950406","122669960936708869006114982608557048832","328763088250435422836999130712035413696","211739489076725607812476063490105667765","141638703454890326429067496788754470760","199966837548834435407804437204200762881","261490629404462201185508042179370375761","16404223645792029503600092442635320744","18278861375283832920611302783856081532","171599445485654572934562279883326190152","46015860123260994606990546628713483162","199419217534886744147096603441495711791","5490366294424843882188422480510760522","159907339341954119328867857229328390729","266379167305941128299752562200156997543","163939404589066666541419238162041259706","190893879977609539443913433348050829268","88317630091678782345700262663917075208","23692016544369406808673701492767289018","196348174667685681635848625785139481334","53350124709609136729466963933136363528","42243062627570949681318621884620636737","125485040162517445626606605765657966748","113016388921423937688974813141830670998"],"threshold":0.9}},{"target":{"function":"parseKnownActivityEmbeddingCerts","file":"core/java/com/android/internal/pm/pkg/parsing/ParsingUtils.java"},"deprecated":false,"digest":{"function_hash":"247746600246818536682223738846478141763","length":1022},"id":"ASB-A-429417238-e4ccea30","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/58e6711dd5df6aa4d6da7f1e5de2f75cf10475f0"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/58e6711dd5df6aa4d6da7f1e5de2f75cf10475f0"],"severity":"High","spl":"2026-11-01","types":["DoS"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-429417238.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"spl":"2026-11-01","types":["DoS"],"vanir_signatures":[{"digest":{"function_hash":"247746600246818536682223738846478141763","length":1022},"id":"ASB-A-429417238-ba802e3b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5c47d86bbf21b44eced5551da433934109f10cd2","target":{"function":"parseKnownActivityEmbeddingCerts","file":"core/java/com/android/internal/pm/pkg/parsing/ParsingUtils.java"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5c47d86bbf21b44eced5551da433934109f10cd2","target":{"file":"core/java/com/android/internal/pm/pkg/parsing/ParsingUtils.java"},"deprecated":false,"digest":{"line_hashes":["306136529359641075513368964209708263678","123507770211255993651813289831972339760","3655616931828042997627322190628965527","332909460807459735099002142028160808396","304227493300646502449332491813484550862","245570317473973978117202907087829441441","196763123319378797482176461983037514634","256312972263055212677532211445382668670","337253228926897386829257334302070166490","300890432004437832092040560689949481155","50963977145015276314728445967738950406","122669960936708869006114982608557048832","328763088250435422836999130712035413696","211739489076725607812476063490105667765","141638703454890326429067496788754470760","199966837548834435407804437204200762881","261490629404462201185508042179370375761","16404223645792029503600092442635320744","18278861375283832920611302783856081532","171599445485654572934562279883326190152","46015860123260994606990546628713483162","199419217534886744147096603441495711791","5490366294424843882188422480510760522","159907339341954119328867857229328390729","266379167305941128299752562200156997543","163939404589066666541419238162041259706","190893879977609539443913433348050829268","88317630091678782345700262663917075208","23692016544369406808673701492767289018","196348174667685681635848625785139481334","53350124709609136729466963933136363528","42243062627570949681318621884620636737","125485040162517445626606605765657966748","113016388921423937688974813141830670998"],"threshold":0.9},"id":"ASB-A-429417238-fa62e0d8"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/5c47d86bbf21b44eced5551da433934109f10cd2"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-429417238.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/eacbf7119d279cebd4ef3334d33bcbdb647fdbc3","target":{"file":"services/core/java/com/android/server/pm/pkg/parsing/ParsingUtils.java","function":"parseKnownActivityEmbeddingCerts"},"deprecated":false,"digest":{"length":1022,"function_hash":"247746600246818536682223738846478141763"},"id":"ASB-A-429417238-6cd1667c"},{"id":"ASB-A-429417238-d5d741cb","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/eacbf7119d279cebd4ef3334d33bcbdb647fdbc3","target":{"file":"services/core/java/com/android/server/pm/pkg/parsing/ParsingUtils.java"},"deprecated":false,"digest":{"line_hashes":["77168529489992102237453041860761451085","123507770211255993651813289831972339760","3655616931828042997627322190628965527","332909460807459735099002142028160808396","304227493300646502449332491813484550862","245570317473973978117202907087829441441","196763123319378797482176461983037514634","256312972263055212677532211445382668670","337253228926897386829257334302070166490","300890432004437832092040560689949481155","50963977145015276314728445967738950406","122669960936708869006114982608557048832","328763088250435422836999130712035413696","211739489076725607812476063490105667765","141638703454890326429067496788754470760","199966837548834435407804437204200762881","261490629404462201185508042179370375761","16404223645792029503600092442635320744","18278861375283832920611302783856081532","171599445485654572934562279883326190152","46015860123260994606990546628713483162","199419217534886744147096603441495711791","5490366294424843882188422480510760522","159907339341954119328867857229328390729","266379167305941128299752562200156997543","163939404589066666541419238162041259706","190893879977609539443913433348050829268","88317630091678782345700262663917075208","23692016544369406808673701492767289018","196348174667685681635848625785139481334","53350124709609136729466963933136363528","42243062627570949681318621884620636737","125485040162517445626606605765657966748","113016388921423937688974813141830670998"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/eacbf7119d279cebd4ef3334d33bcbdb647fdbc3"],"severity":"High","spl":"2026-11-01","types":["DoS"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-429417238.json"}}],"schema_version":"1.9.2"}