{"id":"ASB-A-462431486","details":"In setTo of ResourceTypes.cpp, there is a possible read out of bounds due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-462431486","CVE-2026-0056"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2026-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-06-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/d5a52f737cabce3d9a58e8c23f6201ea658287ac"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-06-01"}]}],"versions":["17-next"],"ecosystem_specific":{"spl":"2026-06-01","types":["ID"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/62cb59ae21e6b27e510ee3af58d0df8ad9bc70a7","target":{"file":"libs/androidfw/ResourceTypes.cpp"},"deprecated":true,"digest":{"line_hashes":["8452595436483369908964570222293407816","240049574011380129851974735556274716515","146292951287316629006329247049540378873","332327962866772784024985154157400931817"],"threshold":0.9},"id":"ASB-A-462431486-8dd09007","match_only_versions":["17-next"],"signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"length":6951,"function_hash":"89959887183818722895329504211086005178"},"id":"ASB-A-462431486-fd5e4ece","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/62cb59ae21e6b27e510ee3af58d0df8ad9bc70a7","target":{"file":"libs/androidfw/ResourceTypes.cpp","function":"ResStringPool::setTo"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/62cb59ae21e6b27e510ee3af58d0df8ad9bc70a7"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-462431486.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-06-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["ID"],"vanir_signatures":[{"id":"ASB-A-462431486-19e79a15","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/af1c7798ac9cebe96febe76dcd1cd3c39ccba3a9","target":{"function":"ResStringPool::setTo","file":"libs/androidfw/ResourceTypes.cpp"},"deprecated":false,"digest":{"length":6951,"function_hash":"89959887183818722895329504211086005178"}},{"match_only_versions":["15"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/af1c7798ac9cebe96febe76dcd1cd3c39ccba3a9","target":{"file":"libs/androidfw/ResourceTypes.cpp"},"deprecated":true,"digest":{"line_hashes":["8452595436483369908964570222293407816","240049574011380129851974735556274716515","146292951287316629006329247049540378873","332327962866772784024985154157400931817"],"threshold":0.9},"id":"ASB-A-462431486-d2a70ea5"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/af1c7798ac9cebe96febe76dcd1cd3c39ccba3a9"],"severity":"High","spl":"2026-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-462431486.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-06-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"High","spl":"2026-06-01","types":["ID"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/5d8844413d903d3b526708e9b8dd73b886b68173","target":{"file":"libs/androidfw/ResourceTypes.cpp","function":"ResStringPool::setTo"},"deprecated":false,"digest":{"function_hash":"89959887183818722895329504211086005178","length":6951},"id":"ASB-A-462431486-43b99340","signature_type":"Function","signature_version":"v1"},{"target":{"file":"libs/androidfw/ResourceTypes.cpp"},"deprecated":true,"digest":{"threshold":0.9,"line_hashes":["8452595436483369908964570222293407816","240049574011380129851974735556274716515","146292951287316629006329247049540378873","332327962866772784024985154157400931817"]},"id":"ASB-A-462431486-6418c60c","match_only_versions":["16"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5d8844413d903d3b526708e9b8dd73b886b68173"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/5d8844413d903d3b526708e9b8dd73b886b68173"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-462431486.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-06-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"types":["ID"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/736e4927305774d9537d562dde282f8968a7345d","target":{"file":"libs/androidfw/ResourceTypes.cpp"},"deprecated":true,"digest":{"line_hashes":["8452595436483369908964570222293407816","240049574011380129851974735556274716515","146292951287316629006329247049540378873","332327962866772784024985154157400931817"],"threshold":0.9},"id":"ASB-A-462431486-cab4fc35","match_only_versions":["16-qpr2"],"signature_type":"Line","signature_version":"v1"},{"target":{"file":"libs/androidfw/ResourceTypes.cpp","function":"ResStringPool::setTo"},"deprecated":false,"digest":{"function_hash":"89959887183818722895329504211086005178","length":6951},"id":"ASB-A-462431486-fbe9a81d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/736e4927305774d9537d562dde282f8968a7345d"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/736e4927305774d9537d562dde282f8968a7345d"],"severity":"High","spl":"2026-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-462431486.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-06-01"}]}],"versions":["14"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/049914849588d51bd4a16c365b5da4d684a9f9d0"],"severity":"High","spl":"2026-06-01","types":["ID"],"vanir_signatures":[{"id":"ASB-A-462431486-339581bb","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/049914849588d51bd4a16c365b5da4d684a9f9d0","target":{"function":"ResStringPool::setTo","file":"libs/androidfw/ResourceTypes.cpp"},"deprecated":false,"digest":{"function_hash":"63797612492678972978223693506046679287","length":6722}},{"digest":{"line_hashes":["8452595436483369908964570222293407816","240049574011380129851974735556274716515","146292951287316629006329247049540378873","332327962866772784024985154157400931817"],"threshold":0.9},"id":"ASB-A-462431486-45dbf111","match_only_versions":["14"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/049914849588d51bd4a16c365b5da4d684a9f9d0","target":{"file":"libs/androidfw/ResourceTypes.cpp"},"deprecated":true}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-462431486.json"}}],"schema_version":"1.9.0"}