{"id":"ASB-A-479515555","details":"In fixInitiatingUserIfNecessary of CallIntentProcessor.java, there is a possible way to make an emergency call due to a logic error in the code. This could lead to local escalation with User execution privileges needed. User interaction is needed for exploitation.","aliases":["A-479515555","CVE-2026-28581"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/services/Telecomm/+/c1104b6c1bbebdfa9ba9530569f9eb72c7787ac2"}],"affected":[{"package":{"name":"platform/packages/services/Telecomm","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/services/Telecomm/+/08564e5b3e2792fceba976e7cb7efdd7d13a5c80","https://android.googlesource.com/platform/packages/services/Telecomm/+/9fbd76719bb749e958b0139fa63ef4036e3291e7"],"severity":"High","spl":"2026-09-01","types":["ID"],"vanir_signatures":[{"target":{"file":"src/com/android/server/telecom/CallIntentProcessor.java"},"deprecated":false,"digest":{"line_hashes":["66431614121202309443453330549858745711","85722234273926727707024672700519582272","45037792173073876030756637481557354660","261647221884420380742997954624826651064","116877697697531423445577080027763406472","337646993087339656439631459982085187208","182450678073732992545925457898898970998","304800869397966607260540886851175306917","138248697832457792609235221218660779697","162919330277388219785771283577314200117","166763051067249569881426985444240853021"],"threshold":0.9},"id":"ASB-A-479515555-05d9b95b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/08564e5b3e2792fceba976e7cb7efdd7d13a5c80"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/9fbd76719bb749e958b0139fa63ef4036e3291e7","target":{"file":"src/com/android/server/telecom/CallIntentProcessor.java"},"deprecated":false,"digest":{"line_hashes":["267675737814392314599079443262628018538","129683185035301515800774035555900214112","68905898478925979546211270924781482336","53047812372526360827628699981855794607","127999017629219175621004685008763447413","70541035683820568437079967347229412063","116643534636384174967840366105987294680","338377055448650109471727060983484389576","181027422192291392380962824184292699602","261464685198007851940688248116344664558","157048102382831792934933006765471074280"],"threshold":0.9},"id":"ASB-A-479515555-2b970b5b","signature_type":"Line"},{"source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/9fbd76719bb749e958b0139fa63ef4036e3291e7","target":{"file":"src/com/android/server/telecom/CallIntentProcessor.java","function":"doesUserHaveDialerRoleHolder"},"deprecated":false,"digest":{"length":207,"function_hash":"246143970706125164216133261183943954257"},"id":"ASB-A-479515555-6afcf9c2","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"126424447260934364440106620156680549008","length":586},"id":"ASB-A-479515555-b43fcee6","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/08564e5b3e2792fceba976e7cb7efdd7d13a5c80","target":{"file":"src/com/android/server/telecom/CallIntentProcessor.java","function":"fixInitiatingUserIfNecessary"},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-479515555.json"}},{"package":{"name":"platform/packages/services/Telecomm","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["ID"],"vanir_signatures":[{"id":"ASB-A-479515555-00251661","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/a86f430daab38ab0125d0d52a63a8d47d9238d6b","target":{"file":"src/com/android/server/telecom/CallIntentProcessor.java"},"deprecated":false,"digest":{"line_hashes":["275697973930546671872197870279814498366","118068018422795785858897453327500768995","327454928041141465829333481050287513005","289153676328094347291146770935468944549","101033629972494158161172369341825576507","2359310838084256022684050394245863863","337646993087339656439631459982085187208","163792305648947912070277963972014955233","116796829160323168408309576398414666866","271943106620621339800345114757018215409","122146977194100351923197713842661843312","43417371141562557200177395211767691851"],"threshold":0.9}},{"target":{"file":"src/com/android/server/telecom/CallIntentProcessor.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["68905898478925979546211270924781482336","53047812372526360827628699981855794607","11831463864589231895433969120711873578","321658385932467858369125745227495735530","127999017629219175621004685008763447413","70541035683820568437079967347229412063","116643534636384174967840366105987294680","338377055448650109471727060983484389576","181027422192291392380962824184292699602","261464685198007851940688248116344664558","157048102382831792934933006765471074280"]},"id":"ASB-A-479515555-0e8a84c0","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/eefb70468acb73dcf4a6431310df4ef7f2e103ca"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/eefb70468acb73dcf4a6431310df4ef7f2e103ca","target":{"file":"src/com/android/server/telecom/CallIntentProcessor.java","function":"doesUserHaveDialerRoleHolder"},"deprecated":false,"digest":{"length":207,"function_hash":"246143970706125164216133261183943954257"},"id":"ASB-A-479515555-2e239548"},{"source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/a86f430daab38ab0125d0d52a63a8d47d9238d6b","target":{"function":"fixInitiatingUserIfNecessary","file":"src/com/android/server/telecom/CallIntentProcessor.java"},"deprecated":false,"digest":{"function_hash":"147944812810273912106650240195157517009","length":687},"id":"ASB-A-479515555-4b3ee144","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/services/Telecomm/+/a86f430daab38ab0125d0d52a63a8d47d9238d6b","https://android.googlesource.com/platform/packages/services/Telecomm/+/eefb70468acb73dcf4a6431310df4ef7f2e103ca"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-479515555.json"}},{"package":{"name":"platform/packages/services/Telecomm","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"types":["ID"],"vanir_signatures":[{"deprecated":false,"digest":{"length":687,"function_hash":"147944812810273912106650240195157517009"},"id":"ASB-A-479515555-1e8be35d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/6337a6f9997d4c1a560d2d41495e925914b8872b","target":{"file":"src/com/android/server/telecom/CallIntentProcessor.java","function":"fixInitiatingUserIfNecessary"}},{"id":"ASB-A-479515555-24fd00ee","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/6337a6f9997d4c1a560d2d41495e925914b8872b","target":{"file":"src/com/android/server/telecom/CallIntentProcessor.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["275697973930546671872197870279814498366","118068018422795785858897453327500768995","327454928041141465829333481050287513005","289153676328094347291146770935468944549","101033629972494158161172369341825576507","2359310838084256022684050394245863863","337646993087339656439631459982085187208","163792305648947912070277963972014955233","116796829160323168408309576398414666866","271943106620621339800345114757018215409","122146977194100351923197713842661843312","43417371141562557200177395211767691851"]}},{"deprecated":false,"digest":{"line_hashes":["68905898478925979546211270924781482336","53047812372526360827628699981855794607","11831463864589231895433969120711873578","321658385932467858369125745227495735530","127999017629219175621004685008763447413","70541035683820568437079967347229412063","116643534636384174967840366105987294680","338377055448650109471727060983484389576","181027422192291392380962824184292699602","261464685198007851940688248116344664558","157048102382831792934933006765471074280"],"threshold":0.9},"id":"ASB-A-479515555-9a309e31","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/f6e758a0decb2c885a728701d0b4727051b0236a","target":{"file":"src/com/android/server/telecom/CallIntentProcessor.java"}},{"id":"ASB-A-479515555-dd1a3904","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/f6e758a0decb2c885a728701d0b4727051b0236a","target":{"function":"doesUserHaveDialerRoleHolder","file":"src/com/android/server/telecom/CallIntentProcessor.java"},"deprecated":false,"digest":{"length":207,"function_hash":"246143970706125164216133261183943954257"}}],"fixes":["https://android.googlesource.com/platform/packages/services/Telecomm/+/6337a6f9997d4c1a560d2d41495e925914b8872b","https://android.googlesource.com/platform/packages/services/Telecomm/+/f6e758a0decb2c885a728701d0b4727051b0236a"],"severity":"High","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-479515555.json"}},{"package":{"name":"platform/packages/services/Telecomm","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"spl":"2026-09-01","types":["ID"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/a97c5e458eec6734bbb9b41ad992aec560a1341b","target":{"function":"doesUserHaveDialerRoleHolder","file":"src/com/android/server/telecom/CallIntentProcessor.java"},"deprecated":false,"digest":{"function_hash":"246143970706125164216133261183943954257","length":207},"id":"ASB-A-479515555-0976155e"},{"source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/f151e1fcd02f6f3fc5c9163f1c453b2860a4c045","target":{"file":"src/com/android/server/telecom/CallIntentProcessor.java","function":"fixInitiatingUserIfNecessary"},"deprecated":false,"digest":{"function_hash":"147944812810273912106650240195157517009","length":687},"id":"ASB-A-479515555-3c3785db","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/a97c5e458eec6734bbb9b41ad992aec560a1341b","target":{"file":"src/com/android/server/telecom/CallIntentProcessor.java"},"deprecated":false,"digest":{"line_hashes":["68905898478925979546211270924781482336","53047812372526360827628699981855794607","11831463864589231895433969120711873578","321658385932467858369125745227495735530","127999017629219175621004685008763447413","70541035683820568437079967347229412063","116643534636384174967840366105987294680","338377055448650109471727060983484389576","181027422192291392380962824184292699602","261464685198007851940688248116344664558","157048102382831792934933006765471074280"],"threshold":0.9},"id":"ASB-A-479515555-5d39aff8","signature_type":"Line"},{"source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/f151e1fcd02f6f3fc5c9163f1c453b2860a4c045","target":{"file":"src/com/android/server/telecom/CallIntentProcessor.java"},"deprecated":false,"digest":{"line_hashes":["275697973930546671872197870279814498366","118068018422795785858897453327500768995","327454928041141465829333481050287513005","289153676328094347291146770935468944549","101033629972494158161172369341825576507","2359310838084256022684050394245863863","337646993087339656439631459982085187208","163792305648947912070277963972014955233","116796829160323168408309576398414666866","271943106620621339800345114757018215409","122146977194100351923197713842661843312","43417371141562557200177395211767691851"],"threshold":0.9},"id":"ASB-A-479515555-f2a58dd5","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/services/Telecomm/+/f151e1fcd02f6f3fc5c9163f1c453b2860a4c045","https://android.googlesource.com/platform/packages/services/Telecomm/+/a97c5e458eec6734bbb9b41ad992aec560a1341b"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-479515555.json"}},{"package":{"name":"platform/packages/services/Telecomm","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"spl":"2026-09-01","types":["ID"],"vanir_signatures":[{"deprecated":false,"digest":{"length":207,"function_hash":"246143970706125164216133261183943954257"},"id":"ASB-A-479515555-3b0f495c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/9f1db87e7fdbf1ad0f522da593e31b1eab821fbd","target":{"file":"src/com/android/server/telecom/CallIntentProcessor.java","function":"doesUserHaveDialerRoleHolder"}},{"id":"ASB-A-479515555-aab06107","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/9f1db87e7fdbf1ad0f522da593e31b1eab821fbd","target":{"file":"src/com/android/server/telecom/CallIntentProcessor.java"},"deprecated":false,"digest":{"line_hashes":["68905898478925979546211270924781482336","53047812372526360827628699981855794607","11831463864589231895433969120711873578","321658385932467858369125745227495735530","127999017629219175621004685008763447413","70541035683820568437079967347229412063","116643534636384174967840366105987294680","338377055448650109471727060983484389576","181027422192291392380962824184292699602","261464685198007851940688248116344664558","157048102382831792934933006765471074280"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/packages/services/Telecomm/+/9f1db87e7fdbf1ad0f522da593e31b1eab821fbd"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-479515555.json"}},{"package":{"name":"platform/packages/services/Telecomm","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-09-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["ID"],"vanir_signatures":[{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["329126198837252724337213746139986537055","181032711899714146078876874130380169599","269378219457655455870167628632489881009","185505139240680436019231179980257610568","197989231643528225879798480018686206949","51076208683751939128284972749987978057","116643534636384174967840366105987294680","338377055448650109471727060983484389576","181027422192291392380962824184292699602","37447437924711782994553541346783604660","20988540865428991881343994699176781876"]},"id":"ASB-A-479515555-11d63f36","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/d7c83134ff471b5ae7ee4bc0ef4af9f7be8720da","target":{"file":"src/com/android/server/telecom/CallIntentProcessor.java"}},{"id":"ASB-A-479515555-274951fd","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/35e2990a9f97b4f637b0396c22d3bec4e413f1a0","target":{"file":"src/com/android/server/telecom/CallIntentProcessor.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["26133594050890876242597793979873651939","23027160242320661723826400181933955419","134003649263944159803455138007528835909","45112863112017604105325695094066063364","20682045683875465157964150065147853118","189143468501045841175881075332109934859","198988075881470600786893976971362781120","16462722562690242764208739049192321535","280028134228199225938091360648394600619","339588260457547530918512251536013040245"]}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/d7c83134ff471b5ae7ee4bc0ef4af9f7be8720da","target":{"file":"src/com/android/server/telecom/CallIntentProcessor.java","function":"doesUserHaveDialerRoleHolder"},"deprecated":false,"digest":{"length":207,"function_hash":"246143970706125164216133261183943954257"},"id":"ASB-A-479515555-653f285b","signature_type":"Function"},{"source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/35e2990a9f97b4f637b0396c22d3bec4e413f1a0","target":{"function":"fixInitiatingUserIfNecessary","file":"src/com/android/server/telecom/CallIntentProcessor.java"},"deprecated":false,"digest":{"function_hash":"215484692214529044550919816741495831142","length":609},"id":"ASB-A-479515555-92be8e19","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/services/Telecomm/+/35e2990a9f97b4f637b0396c22d3bec4e413f1a0","https://android.googlesource.com/platform/packages/services/Telecomm/+/d7c83134ff471b5ae7ee4bc0ef4af9f7be8720da"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-479515555.json"}}],"schema_version":"1.9.0"}