{"id":"ASB-A-459460951","details":"In multiple functions of SmsController.java, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-459460951","CVE-2026-58874"],"modified":"2026-09-09T15:15:54.249544283Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/c6e940d710fbd4383f2e999f4d1a2234c0ae11dc"],"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c6e940d710fbd4383f2e999f4d1a2234c0ae11dc","target":{"file":"telephony/common/com/android/internal/telephony/TelephonyPermissions.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["314491743165801948123262950922210516532","281711988256244874554787287552216749399","83841026515189704200015352038518875857","134548027252990306907230439262372317069","242557198168100842837376928432032907867","212198471106597362628783621170278581071","116741174541360479486316790328088464386","273368188948173911464489148214274841410","165752730715071622491233163929213851290"]},"id":"ASB-A-459460951-1aea3df8"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c6e940d710fbd4383f2e999f4d1a2234c0ae11dc","target":{"file":"telephony/common/com/android/internal/telephony/TelephonyPermissions.java","function":"checkSubscriptionAssociatedWithUser"},"deprecated":false,"digest":{"function_hash":"141782428824802642949931918294330175748","length":608},"id":"ASB-A-459460951-be735a98"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-459460951.json"}},{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"vanir_signatures":[{"id":"ASB-A-459460951-0b86aebe","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/6cffd2ed55767990357cf11ab54718954ac6d961","target":{"file":"src/java/com/android/internal/telephony/SmsController.java","function":"sendStoredText"},"deprecated":false,"digest":{"length":719,"function_hash":"49785933579441875669908815356361611936"}},{"target":{"file":"src/java/com/android/internal/telephony/SmsController.java","function":"sendStoredMultipartText"},"deprecated":false,"digest":{"function_hash":"234495463127686722443156479948848580485","length":747},"id":"ASB-A-459460951-98900e6c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/6cffd2ed55767990357cf11ab54718954ac6d961"},{"digest":{"line_hashes":["98043236030772146082793337236296238717","108438292240198667044992932427419031023","12005593342205208870274374818040482355","325710822266304529067751621639196001352"],"threshold":0.9},"id":"ASB-A-459460951-d2c6637d","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/6cffd2ed55767990357cf11ab54718954ac6d961","target":{"file":"src/java/com/android/internal/telephony/IccSmsInterfaceManager.java"},"deprecated":false},{"id":"ASB-A-459460951-d4015021","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/6cffd2ed55767990357cf11ab54718954ac6d961","target":{"file":"src/java/com/android/internal/telephony/SmsController.java"},"deprecated":false,"digest":{"line_hashes":["90228688156430979903343446701831398516","264631826315680333814687486510804304030","87613765760672379253449611814982469956","317017134271730343835728322008917066771","272125616025489698398826578524128504483","110248927711739923489248316846811819917","18635445160070284091469821276910560372","143951072537177597762714706957505342215","111772090368289363102083054791839693323","18130604361217788038250834497169969686","36774268761721323831576035399644438143","243448042227188207368857343813622762477","205711528463042389763454601506716539833"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/6cffd2ed55767990357cf11ab54718954ac6d961"],"severity":"High","spl":"2026-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-459460951.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/317601a2835578dd049383101ce380f27e34ef41","target":{"file":"telephony/common/com/android/internal/telephony/TelephonyPermissions.java","function":"checkSubscriptionAssociatedWithUser"},"deprecated":false,"digest":{"function_hash":"141782428824802642949931918294330175748","length":608},"id":"ASB-A-459460951-29c7ba68","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/317601a2835578dd049383101ce380f27e34ef41","target":{"file":"telephony/common/com/android/internal/telephony/TelephonyPermissions.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["314491743165801948123262950922210516532","281711988256244874554787287552216749399","83841026515189704200015352038518875857","134548027252990306907230439262372317069","242557198168100842837376928432032907867","212198471106597362628783621170278581071","116741174541360479486316790328088464386","273368188948173911464489148214274841410","165752730715071622491233163929213851290"]},"id":"ASB-A-459460951-8b856d65"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/317601a2835578dd049383101ce380f27e34ef41"],"severity":"High","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-459460951.json"}},{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"digest":{"function_hash":"237115520426249656102696369553982150623","length":632},"id":"ASB-A-459460951-124e3c26","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/f03821d51b64e0eac6870f8565694143dadad2af","target":{"function":"sendStoredText","file":"src/java/com/android/internal/telephony/SmsController.java"},"deprecated":false},{"id":"ASB-A-459460951-2bca0fb2","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/f03821d51b64e0eac6870f8565694143dadad2af","target":{"file":"src/java/com/android/internal/telephony/SmsController.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["74775786963757892677466474442989367079","73502138666139269991024399683830686201","279994131248835305918298891509137584136","317017134271730343835728322008917066771","86797430969411904796541856642897395742","198739071019880017494062073610405901429","96002864560410248236344145552632222126","39330019612956078569066622781821208727","260849834579265409309202059693066502580","207227479982182757967255081291369175668","36774268761721323831576035399644438143","243448042227188207368857343813622762477","205711528463042389763454601506716539833"]}},{"source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/f03821d51b64e0eac6870f8565694143dadad2af","target":{"file":"src/java/com/android/internal/telephony/IccSmsInterfaceManager.java"},"deprecated":false,"digest":{"line_hashes":["98043236030772146082793337236296238717","108438292240198667044992932427419031023","12005593342205208870274374818040482355","325710822266304529067751621639196001352"],"threshold":0.9},"id":"ASB-A-459460951-38e0e34c","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"209485642538337701783658441792947791822","length":660},"id":"ASB-A-459460951-98d42f1c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/f03821d51b64e0eac6870f8565694143dadad2af","target":{"file":"src/java/com/android/internal/telephony/SmsController.java","function":"sendStoredMultipartText"}}],"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/f03821d51b64e0eac6870f8565694143dadad2af"],"severity":"High","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-459460951.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/1aae4267206d1a08d30158bfce99a766550f1afd"],"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/1aae4267206d1a08d30158bfce99a766550f1afd","target":{"file":"telephony/common/com/android/internal/telephony/TelephonyPermissions.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["314491743165801948123262950922210516532","281711988256244874554787287552216749399","83841026515189704200015352038518875857","134548027252990306907230439262372317069","242557198168100842837376928432032907867","212198471106597362628783621170278581071","116741174541360479486316790328088464386","273368188948173911464489148214274841410","165752730715071622491233163929213851290"]},"id":"ASB-A-459460951-231b0f38","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1aae4267206d1a08d30158bfce99a766550f1afd","target":{"function":"checkSubscriptionAssociatedWithUser","file":"telephony/common/com/android/internal/telephony/TelephonyPermissions.java"},"deprecated":false,"digest":{"function_hash":"141782428824802642949931918294330175748","length":608},"id":"ASB-A-459460951-9c092e05","signature_type":"Function"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-459460951.json"}},{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"digest":{"line_hashes":["74775786963757892677466474442989367079","73502138666139269991024399683830686201","279994131248835305918298891509137584136","317017134271730343835728322008917066771","297712991158285410917672672985501731946","27453540411357979666228332925531163072","101930701347659089037017261600480075804","215121875714410693865399204354840310654","26898975272359097872418799516659272247","45630850879745698146895133740609720992","86797430969411904796541856642897395742","110248927711739923489248316846811819917","189261087086982396803033661412760932935","307270290257897599719812123790660509009","116390827937237596379501881976627447295","270008887797449153419812292017403152621","27140489876626401156469873938072959187","79494701042987115461538829588879337501","39330019612956078569066622781821208727","111772090368289363102083054791839693323","88205013806212371733316656435845009925","36774268761721323831576035399644438143","243448042227188207368857343813622762477","205711528463042389763454601506716539833"],"threshold":0.9},"id":"ASB-A-459460951-45c819e7","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/92143d3e5ee352208511dff16728c16b0ec299bb","target":{"file":"src/java/com/android/internal/telephony/SmsController.java"},"deprecated":false},{"target":{"file":"src/java/com/android/internal/telephony/IccSmsInterfaceManager.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["98043236030772146082793337236296238717","108438292240198667044992932427419031023","12005593342205208870274374818040482355","325710822266304529067751621639196001352"]},"id":"ASB-A-459460951-4d8fd2c5","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/92143d3e5ee352208511dff16728c16b0ec299bb"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/92143d3e5ee352208511dff16728c16b0ec299bb","target":{"function":"sendStoredMultipartText","file":"src/java/com/android/internal/telephony/SmsController.java"},"deprecated":false,"digest":{"length":717,"function_hash":"150513958370728880399310669791159728820"},"id":"ASB-A-459460951-bae7367e"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/92143d3e5ee352208511dff16728c16b0ec299bb","target":{"file":"src/java/com/android/internal/telephony/SmsController.java","function":"sendStoredText"},"deprecated":false,"digest":{"function_hash":"209947485150884182026183962848039118935","length":689},"id":"ASB-A-459460951-cc24438e"}],"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/92143d3e5ee352208511dff16728c16b0ec299bb"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-459460951.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"target":{"file":"telephony/common/com/android/internal/telephony/TelephonyPermissions.java"},"deprecated":false,"digest":{"line_hashes":["314491743165801948123262950922210516532","281711988256244874554787287552216749399","83841026515189704200015352038518875857","134548027252990306907230439262372317069","242557198168100842837376928432032907867","212198471106597362628783621170278581071","116741174541360479486316790328088464386","273368188948173911464489148214274841410","165752730715071622491233163929213851290"],"threshold":0.9},"id":"ASB-A-459460951-66f6b188","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/3913c258e5da85b42cd60db49f5226c10eebcce2"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/3913c258e5da85b42cd60db49f5226c10eebcce2","target":{"function":"checkSubscriptionAssociatedWithUser","file":"telephony/common/com/android/internal/telephony/TelephonyPermissions.java"},"deprecated":false,"digest":{"length":608,"function_hash":"141782428824802642949931918294330175748"},"id":"ASB-A-459460951-82edb078","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/3913c258e5da85b42cd60db49f5226c10eebcce2"],"severity":"High","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-459460951.json"}},{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"vanir_signatures":[{"id":"ASB-A-459460951-3714dbd2","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/cbecd57d7992d6d8ad40ddee7cc8a45bac88b35d","target":{"file":"src/java/com/android/internal/telephony/SmsController.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["74775786963757892677466474442989367079","73502138666139269991024399683830686201","279994131248835305918298891509137584136","317017134271730343835728322008917066771","272125616025489698398826578524128504483","110248927711739923489248316846811819917","18635445160070284091469821276910560372","143951072537177597762714706957505342215","111772090368289363102083054791839693323","18130604361217788038250834497169969686","36774268761721323831576035399644438143","243448042227188207368857343813622762477","205711528463042389763454601506716539833"]}},{"source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/cbecd57d7992d6d8ad40ddee7cc8a45bac88b35d","target":{"file":"src/java/com/android/internal/telephony/SmsController.java","function":"sendStoredMultipartText"},"deprecated":false,"digest":{"function_hash":"234495463127686722443156479948848580485","length":747},"id":"ASB-A-459460951-603a3716","signature_type":"Function","signature_version":"v1"},{"digest":{"length":719,"function_hash":"49785933579441875669908815356361611936"},"id":"ASB-A-459460951-aa948206","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/cbecd57d7992d6d8ad40ddee7cc8a45bac88b35d","target":{"function":"sendStoredText","file":"src/java/com/android/internal/telephony/SmsController.java"},"deprecated":false},{"target":{"file":"src/java/com/android/internal/telephony/IccSmsInterfaceManager.java"},"deprecated":false,"digest":{"line_hashes":["98043236030772146082793337236296238717","108438292240198667044992932427419031023","12005593342205208870274374818040482355","325710822266304529067751621639196001352"],"threshold":0.9},"id":"ASB-A-459460951-fad03072","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/cbecd57d7992d6d8ad40ddee7cc8a45bac88b35d"}],"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/cbecd57d7992d6d8ad40ddee7cc8a45bac88b35d"],"severity":"High","spl":"2026-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-459460951.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-09-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"digest":{"line_hashes":["314491743165801948123262950922210516532","252598080043004827681757014611365046554","217625807822754269569859293540316366295","159776500266863526666748962523335670120","301540864122162222560784990278895136549","116741174541360479486316790328088464386","273368188948173911464489148214274841410","165752730715071622491233163929213851290"],"threshold":0.9},"id":"ASB-A-459460951-978aa743","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/4b47face486ac4955bbba6b9333a5ce2266572aa","target":{"file":"telephony/common/com/android/internal/telephony/TelephonyPermissions.java"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/4b47face486ac4955bbba6b9333a5ce2266572aa","target":{"function":"checkSubscriptionAssociatedWithUser","file":"telephony/common/com/android/internal/telephony/TelephonyPermissions.java"},"deprecated":false,"digest":{"function_hash":"118426378044520048888982666814326048856","length":586},"id":"ASB-A-459460951-9c469f7b"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/4b47face486ac4955bbba6b9333a5ce2266572aa"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-459460951.json"}},{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-09-01"}]}],"versions":["14"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/534b628339a3e392dd9e3c7492d9f95bdef0f634"],"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-459460951-25a688a4","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/534b628339a3e392dd9e3c7492d9f95bdef0f634","target":{"function":"sendStoredText","file":"src/java/com/android/internal/telephony/SmsController.java"},"deprecated":false,"digest":{"function_hash":"237115520426249656102696369553982150623","length":632}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/534b628339a3e392dd9e3c7492d9f95bdef0f634","target":{"function":"sendStoredMultipartText","file":"src/java/com/android/internal/telephony/SmsController.java"},"deprecated":false,"digest":{"length":660,"function_hash":"209485642538337701783658441792947791822"},"id":"ASB-A-459460951-47b79a01"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/534b628339a3e392dd9e3c7492d9f95bdef0f634","target":{"file":"src/java/com/android/internal/telephony/SmsController.java"},"deprecated":false,"digest":{"line_hashes":["90228688156430979903343446701831398516","264631826315680333814687486510804304030","87613765760672379253449611814982469956","317017134271730343835728322008917066771","127738613636760661849125486534341292321","46497981190808472824079839750577843401","231017406722351973647466605896912637162","87802942734101893942532258000664230763","86797430969411904796541856642897395742","198739071019880017494062073610405901429","96002864560410248236344145552632222126","39330019612956078569066622781821208727","260849834579265409309202059693066502580","207227479982182757967255081291369175668","36774268761721323831576035399644438143","243448042227188207368857343813622762477","11326197185867692115674269153010869525"],"threshold":0.9},"id":"ASB-A-459460951-87c12ffe"},{"id":"ASB-A-459460951-be6ca932","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/534b628339a3e392dd9e3c7492d9f95bdef0f634","target":{"file":"src/java/com/android/internal/telephony/IccSmsInterfaceManager.java"},"deprecated":false,"digest":{"line_hashes":["98043236030772146082793337236296238717","108438292240198667044992932427419031023","12005593342205208870274374818040482355","325710822266304529067751621639196001352"],"threshold":0.9}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-459460951.json"}}],"schema_version":"1.9.0"}