{"id":"ASB-A-469080888","details":"In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic error in the code. This could lead to remote (proximal/adjacent) code execution as the shell user with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-469080888","CVE-2026-0073"],"modified":"2026-06-12T15:08:17.296522730Z","published":"2026-05-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-05-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/modules/adb/+/842d331f9e5fb10770a09379e19240daea057dba"}],"affected":[{"package":{"name":"platform/packages/modules/adb","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2-next:0"},{"fixed":"16-qpr2-next:2026-05-01"}]}],"versions":["16-qpr2-next"],"ecosystem_specific":{"types":["RCE"],"spl":"2026-05-01","severity":"Critical","vanir_signatures":[{"signature_type":"Function","target":{"file":"daemon/auth.cpp","function":"adbd_tls_verify_cert"},"id":"ASB-A-469080888-2e87d07a","digest":{"function_hash":"203504448004128309444519572875803334604","length":1396},"deprecated":false,"source":"https://android.googlesource.com/platform/packages/modules/adb/+/8248d2b1f479aebc66ed7d96ba1f19a4144bc537","signature_version":"v1"},{"signature_type":"Line","target":{"file":"daemon/auth.cpp"},"id":"ASB-A-469080888-69b68eff","digest":{"line_hashes":["224893215141431116621884640799021406516","77172996256398155100791030744919970882","214789650471790579933820413370861251736","117680631746406727787973338370133520341","74351312361888148482404842278859843198","285264562717604403289542446999383994678","13916654935757632675048914678619121002","185883513677906872003985050370687979258"],"threshold":0.9},"deprecated":false,"source":"https://android.googlesource.com/platform/packages/modules/adb/+/8248d2b1f479aebc66ed7d96ba1f19a4144bc537","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/modules/adb/+/8248d2b1f479aebc66ed7d96ba1f19a4144bc537"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-469080888.json"}},{"package":{"name":"platform/packages/modules/adb","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-05-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["RCE"],"spl":"2026-05-01","severity":"Critical","vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/modules/adb/+/078ca3f710538c29d61a90ba407b40e0557a9060","target":{"file":"daemon/auth.cpp"},"id":"ASB-A-469080888-4e3278d2","digest":{"line_hashes":["224893215141431116621884640799021406516","88540872520118927895502783251328010206","231652011000281601216617313030116753017","159311208688490002939171878391514179136","310809038979613984236497948207650751269","170345696339408764192165669549353401672","31031634468312048018261451951634278460","176810422543101356939799662400475236407"],"threshold":0.9},"deprecated":false,"signature_type":"Line","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/packages/modules/adb/+/078ca3f710538c29d61a90ba407b40e0557a9060","target":{"file":"daemon/auth.cpp","function":"adbd_tls_verify_cert"},"id":"ASB-A-469080888-9ce26f98","digest":{"function_hash":"70399475931218217740260169085352628042","length":1396},"deprecated":false,"signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/modules/adb/+/078ca3f710538c29d61a90ba407b40e0557a9060"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-469080888.json"}},{"package":{"name":"platform/packages/modules/adb","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-05-01"}]}],"versions":["16"],"ecosystem_specific":{"types":["RCE"],"spl":"2026-05-01","severity":"Critical","vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/modules/adb/+/5c70d050400f748f55f3fce536fb37f37ade9a9f","target":{"file":"daemon/auth.cpp","function":"adbd_tls_verify_cert"},"id":"ASB-A-469080888-358a7bdf","digest":{"function_hash":"203504448004128309444519572875803334604","length":1396},"signature_type":"Function","deprecated":false,"signature_version":"v1"},{"source":"https://android.googlesource.com/platform/packages/modules/adb/+/5c70d050400f748f55f3fce536fb37f37ade9a9f","target":{"file":"daemon/auth.cpp"},"id":"ASB-A-469080888-60193383","digest":{"line_hashes":["224893215141431116621884640799021406516","77172996256398155100791030744919970882","214789650471790579933820413370861251736","117680631746406727787973338370133520341","74351312361888148482404842278859843198","285264562717604403289542446999383994678","13916654935757632675048914678619121002","185883513677906872003985050370687979258"],"threshold":0.9},"deprecated":false,"signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/modules/adb/+/5c70d050400f748f55f3fce536fb37f37ade9a9f"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-469080888.json"}},{"package":{"name":"platform/packages/modules/adb","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-05-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"types":["RCE"],"spl":"2026-05-01","severity":"Critical","vanir_signatures":[{"signature_type":"Line","target":{"file":"daemon/auth.cpp"},"id":"ASB-A-469080888-1c6e5817","digest":{"line_hashes":["224893215141431116621884640799021406516","77172996256398155100791030744919970882","214789650471790579933820413370861251736","117680631746406727787973338370133520341","74351312361888148482404842278859843198","285264562717604403289542446999383994678","13916654935757632675048914678619121002","185883513677906872003985050370687979258"],"threshold":0.9},"deprecated":false,"source":"https://android.googlesource.com/platform/packages/modules/adb/+/d722ffcd5204474e298aac75acae97d913513953","signature_version":"v1"},{"signature_type":"Function","deprecated":false,"id":"ASB-A-469080888-c954efac","digest":{"function_hash":"203504448004128309444519572875803334604","length":1396},"target":{"file":"daemon/auth.cpp","function":"adbd_tls_verify_cert"},"source":"https://android.googlesource.com/platform/packages/modules/adb/+/d722ffcd5204474e298aac75acae97d913513953","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/modules/adb/+/d722ffcd5204474e298aac75acae97d913513953"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-469080888.json"}},{"package":{"name":"platform/packages/modules/adb","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-05-01"}]}],"versions":["14"],"ecosystem_specific":{"types":["RCE"],"spl":"2026-05-01","severity":"Critical","vanir_signatures":[{"signature_type":"Line","deprecated":false,"id":"ASB-A-469080888-71354085","digest":{"line_hashes":["224893215141431116621884640799021406516","88540872520118927895502783251328010206","231652011000281601216617313030116753017","159311208688490002939171878391514179136","310809038979613984236497948207650751269","170345696339408764192165669549353401672","31031634468312048018261451951634278460","176810422543101356939799662400475236407"],"threshold":0.9},"target":{"file":"daemon/auth.cpp"},"source":"https://android.googlesource.com/platform/packages/modules/adb/+/9ea785da0820d2b6422179c85435adf54425fa4e","signature_version":"v1"},{"signature_type":"Function","deprecated":false,"id":"ASB-A-469080888-b8048629","digest":{"function_hash":"70399475931218217740260169085352628042","length":1396},"target":{"file":"daemon/auth.cpp","function":"adbd_tls_verify_cert"},"source":"https://android.googlesource.com/platform/packages/modules/adb/+/9ea785da0820d2b6422179c85435adf54425fa4e","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/modules/adb/+/9ea785da0820d2b6422179c85435adf54425fa4e"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-469080888.json"}}],"schema_version":"1.7.5"}