{"id":"ASB-A-469080888","details":"In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic error in the code. This could lead to remote (proximal/adjacent) code execution as the shell user with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-469080888","CVE-2026-0073"],"modified":"2026-09-23T18:42:52.954000943Z","published":"2026-05-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-05-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/modules/adb/+/842d331f9e5fb10770a09379e19240daea057dba"}],"affected":[{"package":{"name":"platform/packages/modules/adb","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2-next:0"},{"fixed":"16-qpr2-next:2026-05-01"}]}],"versions":["16-qpr2-next"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/adb/+/8248d2b1f479aebc66ed7d96ba1f19a4144bc537","target":{"function":"adbd_tls_verify_cert","file":"daemon/auth.cpp"},"deprecated":false,"digest":{"function_hash":"203504448004128309444519572875803334604","length":1396},"id":"ASB-A-469080888-2e87d07a","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["224893215141431116621884640799021406516","77172996256398155100791030744919970882","214789650471790579933820413370861251736","117680631746406727787973338370133520341","74351312361888148482404842278859843198","285264562717604403289542446999383994678","13916654935757632675048914678619121002","185883513677906872003985050370687979258"],"threshold":0.9},"id":"ASB-A-469080888-69b68eff","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/adb/+/8248d2b1f479aebc66ed7d96ba1f19a4144bc537","target":{"file":"daemon/auth.cpp"}}],"fixes":["https://android.googlesource.com/platform/packages/modules/adb/+/8248d2b1f479aebc66ed7d96ba1f19a4144bc537"],"severity":"Critical","spl":"2026-05-01","types":["RCE"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-469080888.json"}},{"package":{"name":"platform/packages/modules/adb","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-05-01"}]}],"versions":["15"],"ecosystem_specific":{"spl":"2026-05-01","types":["RCE"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/adb/+/078ca3f710538c29d61a90ba407b40e0557a9060","target":{"file":"daemon/auth.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["224893215141431116621884640799021406516","88540872520118927895502783251328010206","231652011000281601216617313030116753017","159311208688490002939171878391514179136","310809038979613984236497948207650751269","170345696339408764192165669549353401672","31031634468312048018261451951634278460","176810422543101356939799662400475236407"]},"id":"ASB-A-469080888-4e3278d2"},{"digest":{"length":1396,"function_hash":"70399475931218217740260169085352628042"},"id":"ASB-A-469080888-9ce26f98","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/adb/+/078ca3f710538c29d61a90ba407b40e0557a9060","target":{"file":"daemon/auth.cpp","function":"adbd_tls_verify_cert"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/modules/adb/+/078ca3f710538c29d61a90ba407b40e0557a9060"],"severity":"Critical"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-469080888.json"}},{"package":{"name":"platform/packages/modules/adb","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-05-01"}]}],"versions":["16"],"ecosystem_specific":{"types":["RCE"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/adb/+/5c70d050400f748f55f3fce536fb37f37ade9a9f","target":{"file":"daemon/auth.cpp","function":"adbd_tls_verify_cert"},"deprecated":false,"digest":{"function_hash":"203504448004128309444519572875803334604","length":1396},"id":"ASB-A-469080888-358a7bdf","signature_type":"Function"},{"source":"https://android.googlesource.com/platform/packages/modules/adb/+/5c70d050400f748f55f3fce536fb37f37ade9a9f","target":{"file":"daemon/auth.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["224893215141431116621884640799021406516","77172996256398155100791030744919970882","214789650471790579933820413370861251736","117680631746406727787973338370133520341","74351312361888148482404842278859843198","285264562717604403289542446999383994678","13916654935757632675048914678619121002","185883513677906872003985050370687979258"]},"id":"ASB-A-469080888-60193383","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/modules/adb/+/5c70d050400f748f55f3fce536fb37f37ade9a9f"],"severity":"Critical","spl":"2026-05-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-469080888.json"}},{"package":{"name":"platform/packages/modules/adb","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-05-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"types":["RCE"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["224893215141431116621884640799021406516","77172996256398155100791030744919970882","214789650471790579933820413370861251736","117680631746406727787973338370133520341","74351312361888148482404842278859843198","285264562717604403289542446999383994678","13916654935757632675048914678619121002","185883513677906872003985050370687979258"],"threshold":0.9},"id":"ASB-A-469080888-1c6e5817","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/adb/+/d722ffcd5204474e298aac75acae97d913513953","target":{"file":"daemon/auth.cpp"}},{"id":"ASB-A-469080888-c954efac","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/adb/+/d722ffcd5204474e298aac75acae97d913513953","target":{"function":"adbd_tls_verify_cert","file":"daemon/auth.cpp"},"deprecated":false,"digest":{"length":1396,"function_hash":"203504448004128309444519572875803334604"}}],"fixes":["https://android.googlesource.com/platform/packages/modules/adb/+/d722ffcd5204474e298aac75acae97d913513953"],"severity":"Critical","spl":"2026-05-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-469080888.json"}},{"package":{"name":"platform/packages/modules/adb","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-05-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"Critical","spl":"2026-05-01","types":["RCE"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/adb/+/9ea785da0820d2b6422179c85435adf54425fa4e","target":{"file":"daemon/auth.cpp"},"deprecated":false,"digest":{"line_hashes":["224893215141431116621884640799021406516","88540872520118927895502783251328010206","231652011000281601216617313030116753017","159311208688490002939171878391514179136","310809038979613984236497948207650751269","170345696339408764192165669549353401672","31031634468312048018261451951634278460","176810422543101356939799662400475236407"],"threshold":0.9},"id":"ASB-A-469080888-71354085"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/adb/+/9ea785da0820d2b6422179c85435adf54425fa4e","target":{"file":"daemon/auth.cpp","function":"adbd_tls_verify_cert"},"deprecated":false,"digest":{"length":1396,"function_hash":"70399475931218217740260169085352628042"},"id":"ASB-A-469080888-b8048629","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/packages/modules/adb/+/9ea785da0820d2b6422179c85435adf54425fa4e"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-469080888.json"}}],"schema_version":"1.9.0"}