{"id":"ASB-A-466091304","details":"In forEachLine of MountRegistry.cpp, there is a possible out of bounds read due to a buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-466091304","CVE-2026-58839"],"modified":"2026-09-10T15:43:18.983809180Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/system/incremental_delivery","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"digest":{"function_hash":"77901611107430095085820501892191841586","length":3257},"id":"ASB-A-466091304-56aa4208","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/incremental_delivery/+/07f1345a34d3b7dd2054f51730a3a2423d75feb2","target":{"file":"incfs/MountRegistry.cpp","function":"MountRegistry::Mounts::loadFrom"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/incremental_delivery/+/07f1345a34d3b7dd2054f51730a3a2423d75feb2","target":{"function":"forEachLine","file":"incfs/MountRegistry.cpp"},"deprecated":false,"digest":{"function_hash":"12874265435631223553710128538833993797","length":900},"id":"ASB-A-466091304-760f0052","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/incremental_delivery/+/07f1345a34d3b7dd2054f51730a3a2423d75feb2","target":{"file":"incfs/MountRegistry.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["213494211576338406158818322625149119112","179033028908046322781903310185765842038","76203621689151990787784922428356750163","207642138715070231107481360527976875625","290465456282574680618849643780810081371","119695939684742444938310553255852257674","321496537711863837832097436927912685892","203388116802623663266026432129982973979","112973675553680936452319393185061860249","327815023930355873693114169759353342655","105130219174071444001332376782260748864"]},"id":"ASB-A-466091304-d4b4b348"}],"fixes":["https://android.googlesource.com/platform/system/incremental_delivery/+/07f1345a34d3b7dd2054f51730a3a2423d75feb2"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-466091304.json"}},{"package":{"name":"platform/system/incremental_delivery","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/incremental_delivery/+/c3b528280e0b621ba78a5a9e080d865f99e69cbd"],"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/incremental_delivery/+/c3b528280e0b621ba78a5a9e080d865f99e69cbd","target":{"file":"incfs/MountRegistry.cpp","function":"forEachLine"},"deprecated":false,"digest":{"function_hash":"12874265435631223553710128538833993797","length":900},"id":"ASB-A-466091304-7a262b2c","signature_type":"Function"},{"source":"https://android.googlesource.com/platform/system/incremental_delivery/+/c3b528280e0b621ba78a5a9e080d865f99e69cbd","target":{"file":"incfs/MountRegistry.cpp","function":"MountRegistry::Mounts::loadFrom"},"deprecated":false,"digest":{"function_hash":"77901611107430095085820501892191841586","length":3257},"id":"ASB-A-466091304-997ec2bd","signature_type":"Function","signature_version":"v1"},{"digest":{"threshold":0.9,"line_hashes":["213494211576338406158818322625149119112","179033028908046322781903310185765842038","76203621689151990787784922428356750163","207642138715070231107481360527976875625","290465456282574680618849643780810081371","119695939684742444938310553255852257674","321496537711863837832097436927912685892","203388116802623663266026432129982973979","112973675553680936452319393185061860249","327815023930355873693114169759353342655","105130219174071444001332376782260748864"]},"id":"ASB-A-466091304-e62f54f7","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/incremental_delivery/+/c3b528280e0b621ba78a5a9e080d865f99e69cbd","target":{"file":"incfs/MountRegistry.cpp"},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-466091304.json"}},{"package":{"name":"platform/system/incremental_delivery","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/incremental_delivery/+/71c3c0252b97e29cefda24bee4f598b925a4d605","target":{"file":"incfs/MountRegistry.cpp","function":"MountRegistry::Mounts::loadFrom"},"deprecated":false,"digest":{"length":3257,"function_hash":"77901611107430095085820501892191841586"},"id":"ASB-A-466091304-771451eb","signature_type":"Function"},{"digest":{"threshold":0.9,"line_hashes":["213494211576338406158818322625149119112","179033028908046322781903310185765842038","76203621689151990787784922428356750163","207642138715070231107481360527976875625","290465456282574680618849643780810081371","119695939684742444938310553255852257674","321496537711863837832097436927912685892","203388116802623663266026432129982973979","112973675553680936452319393185061860249","327815023930355873693114169759353342655","105130219174071444001332376782260748864"]},"id":"ASB-A-466091304-b2878b4e","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/incremental_delivery/+/71c3c0252b97e29cefda24bee4f598b925a4d605","target":{"file":"incfs/MountRegistry.cpp"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/incremental_delivery/+/71c3c0252b97e29cefda24bee4f598b925a4d605","target":{"function":"forEachLine","file":"incfs/MountRegistry.cpp"},"deprecated":false,"digest":{"function_hash":"12874265435631223553710128538833993797","length":900},"id":"ASB-A-466091304-e0695cc7","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/system/incremental_delivery/+/71c3c0252b97e29cefda24bee4f598b925a4d605"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-466091304.json"}},{"package":{"name":"platform/system/incremental_delivery","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"12874265435631223553710128538833993797","length":900},"id":"ASB-A-466091304-4f307dd0","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/incremental_delivery/+/11ecefff0126fdda36405ca7773746275e33426c","target":{"file":"incfs/MountRegistry.cpp","function":"forEachLine"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/incremental_delivery/+/11ecefff0126fdda36405ca7773746275e33426c","target":{"file":"incfs/MountRegistry.cpp"},"deprecated":false,"digest":{"line_hashes":["213494211576338406158818322625149119112","179033028908046322781903310185765842038","76203621689151990787784922428356750163","207642138715070231107481360527976875625","290465456282574680618849643780810081371","119695939684742444938310553255852257674","321496537711863837832097436927912685892","203388116802623663266026432129982973979","112973675553680936452319393185061860249","327815023930355873693114169759353342655","105130219174071444001332376782260748864"],"threshold":0.9},"id":"ASB-A-466091304-6650e358"},{"deprecated":false,"digest":{"function_hash":"77901611107430095085820501892191841586","length":3257},"id":"ASB-A-466091304-bfd3b3f7","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/incremental_delivery/+/11ecefff0126fdda36405ca7773746275e33426c","target":{"file":"incfs/MountRegistry.cpp","function":"MountRegistry::Mounts::loadFrom"}}],"fixes":["https://android.googlesource.com/platform/system/incremental_delivery/+/11ecefff0126fdda36405ca7773746275e33426c"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-466091304.json"}},{"package":{"name":"platform/system/incremental_delivery","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-09-01"}]}],"versions":["14"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"12874265435631223553710128538833993797","length":900},"id":"ASB-A-466091304-3d294bea","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/incremental_delivery/+/85cff3c7b99e1883c8358d0a458f92579da29baa","target":{"file":"incfs/MountRegistry.cpp","function":"forEachLine"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/incremental_delivery/+/85cff3c7b99e1883c8358d0a458f92579da29baa","target":{"file":"incfs/MountRegistry.cpp"},"deprecated":false,"digest":{"line_hashes":["213494211576338406158818322625149119112","179033028908046322781903310185765842038","76203621689151990787784922428356750163","207642138715070231107481360527976875625","290465456282574680618849643780810081371","119695939684742444938310553255852257674","321496537711863837832097436927912685892","203388116802623663266026432129982973979","112973675553680936452319393185061860249","327815023930355873693114169759353342655","105130219174071444001332376782260748864"],"threshold":0.9},"id":"ASB-A-466091304-63b10e77"},{"target":{"file":"incfs/MountRegistry.cpp","function":"MountRegistry::Mounts::loadFrom"},"deprecated":false,"digest":{"function_hash":"77901611107430095085820501892191841586","length":3257},"id":"ASB-A-466091304-856c3b09","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/incremental_delivery/+/85cff3c7b99e1883c8358d0a458f92579da29baa"}],"fixes":["https://android.googlesource.com/platform/system/incremental_delivery/+/85cff3c7b99e1883c8358d0a458f92579da29baa"],"severity":"High","spl":"2026-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-466091304.json"}}],"schema_version":"1.9.0"}