{"id":"ASB-A-470115162","details":"In validateNode of ResourceTypes.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-470115162","CVE-2026-0076"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2026-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-06-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/a91d16a02b51b7a5652031e485508eee655dff47"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-06-01"}]}],"versions":["17-next"],"ecosystem_specific":{"severity":"High","spl":"2026-06-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-470115162-339625e7","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/4d869cd4de74f1dccf30e729bd9caabc3b397e7a","target":{"file":"libs/androidfw/ResourceTypes.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["238711144268367500787365508907809381479","121433671173590328358289261807092112827","251329274194203083262402745867686820167","174148946231678814126456798966772071575"]}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/4d869cd4de74f1dccf30e729bd9caabc3b397e7a","target":{"file":"libs/androidfw/ResourceTypes.cpp","function":"ResXMLTree::validateNode"},"deprecated":false,"digest":{"function_hash":"17037310318613235027383153059887337164","length":2522},"id":"ASB-A-470115162-4669adee","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/4d869cd4de74f1dccf30e729bd9caabc3b397e7a"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-470115162.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-06-01"}]}],"versions":["15"],"ecosystem_specific":{"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/ca02a1c201d088a16f9bc59967dbe1e596950cff","target":{"file":"libs/androidfw/ResourceTypes.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["238711144268367500787365508907809381479","121433671173590328358289261807092112827","251329274194203083262402745867686820167","174148946231678814126456798966772071575"]},"id":"ASB-A-470115162-1041b1d1","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"17037310318613235027383153059887337164","length":2522},"id":"ASB-A-470115162-7457abee","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ca02a1c201d088a16f9bc59967dbe1e596950cff","target":{"function":"ResXMLTree::validateNode","file":"libs/androidfw/ResourceTypes.cpp"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/ca02a1c201d088a16f9bc59967dbe1e596950cff"],"severity":"High","spl":"2026-06-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-470115162.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-06-01"}]}],"versions":["16"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"digest":{"line_hashes":["238711144268367500787365508907809381479","121433671173590328358289261807092112827","251329274194203083262402745867686820167","174148946231678814126456798966772071575"],"threshold":0.9},"id":"ASB-A-470115162-2d473a60","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/10ae6120c62d2eb4cb4ae3f3fc0484d6f594a141","target":{"file":"libs/androidfw/ResourceTypes.cpp"},"deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/base/+/10ae6120c62d2eb4cb4ae3f3fc0484d6f594a141","target":{"file":"libs/androidfw/ResourceTypes.cpp","function":"ResXMLTree::validateNode"},"deprecated":false,"digest":{"function_hash":"17037310318613235027383153059887337164","length":2522},"id":"ASB-A-470115162-e5519bf9","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/10ae6120c62d2eb4cb4ae3f3fc0484d6f594a141"],"severity":"High","spl":"2026-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-470115162.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-06-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"vanir_signatures":[{"id":"ASB-A-470115162-30a772e7","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7f88e0521a216f1295446750d9461816eab37d87","target":{"file":"libs/androidfw/ResourceTypes.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["238711144268367500787365508907809381479","121433671173590328358289261807092112827","251329274194203083262402745867686820167","174148946231678814126456798966772071575"]}},{"deprecated":false,"digest":{"length":2522,"function_hash":"17037310318613235027383153059887337164"},"id":"ASB-A-470115162-c0ccaa80","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7f88e0521a216f1295446750d9461816eab37d87","target":{"file":"libs/androidfw/ResourceTypes.cpp","function":"ResXMLTree::validateNode"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/7f88e0521a216f1295446750d9461816eab37d87"],"severity":"High","spl":"2026-06-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-470115162.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-06-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2026-06-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"libs/androidfw/ResourceTypes.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["238711144268367500787365508907809381479","121433671173590328358289261807092112827","251329274194203083262402745867686820167","174148946231678814126456798966772071575"]},"id":"ASB-A-470115162-bcdb468f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/9b483563ef746b2cfaf1d532b27d45d1be67931a"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/9b483563ef746b2cfaf1d532b27d45d1be67931a","target":{"function":"ResXMLTree::validateNode","file":"libs/androidfw/ResourceTypes.cpp"},"deprecated":false,"digest":{"length":2522,"function_hash":"17037310318613235027383153059887337164"},"id":"ASB-A-470115162-e619502d","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/9b483563ef746b2cfaf1d532b27d45d1be67931a"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-470115162.json"}}],"schema_version":"1.9.0"}