{"id":"ASB-A-481967442","details":"In multiple functions, there is a possible desync in persistence due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-481967442","CVE-2026-28580"],"modified":"2026-06-12T15:08:17.296522730Z","published":"2026-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-06-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/80828212c3187adf56fc2a25d2d24001c5209937"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-06-01"}]}],"versions":["17-next"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Line","id":"ASB-A-481967442-09c20e11","digest":{"threshold":0.9,"line_hashes":["165244540637924401557640048652757763552","257736362510135360840653774735413042773","146129595386038721990984551099174763672","301952237391073482720007218921354080867","71573022188803360753771561952034869011","180106432130842263329597154305917452391","293322401576095725964532517829214158258","70810745183744949730094622808483430570","254115555012421027529185926390220626317","269491136932058675794174344396066394850","309289096885961521629619510083029120887","292278566044345597001780785120999711724","217205556303982368805246957501137554399","196145488914074019479235612975070765329","328477181358208825362340145259055900041","73185503361627566878888113404923428856","274188296471766135728195273722346189842","95351127904209469975589963375414970799","19199824950961330517172029516460358297","249446470169117098854071570937439734209","334258895799137905571381332014549593781","285602280981664444887378475610782202957","306217516614748796354486466595327591516"]},"deprecated":false,"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0f37fd498865590a75f7da7a188c07153cec9e74","target":{"file":"core/java/android/app/NotificationChannel.java"},"match_only_versions":["17-next"]},{"signature_type":"Function","id":"ASB-A-481967442-1a27b79d","digest":{"length":3230,"function_hash":"155213422576754290882979249616505399927"},"deprecated":false,"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0f37fd498865590a75f7da7a188c07153cec9e74","target":{"file":"core/java/android/app/NotificationChannel.java","function":"writeXml"},"match_only_versions":["17-next"]},{"signature_type":"Function","id":"ASB-A-481967442-afab5f20","digest":{"length":2318,"function_hash":"113549265958199584957255370883724330134"},"deprecated":false,"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0f37fd498865590a75f7da7a188c07153cec9e74","target":{"file":"core/java/android/app/NotificationChannel.java","function":"NotificationChannel"},"match_only_versions":["17-next"]}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/0f37fd498865590a75f7da7a188c07153cec9e74"],"spl":"2026-06-01","types":["EoP"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-481967442.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-06-01"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["165244540637924401557640048652757763552","257736362510135360840653774735413042773","146129595386038721990984551099174763672","301952237391073482720007218921354080867","285977560234934879242928721504139102656","162828736071881943805412918618395286789","201931975452051844076884988539719402272","91219096265341906845114753537600964678","199086461619023026386381680070065194960","150742741839475808745571907907247092208","88408364532948866847194171120372312692","321044452669203509211491873396981695059","104805565460518931961332532419712441685","87414709181241507161833155175896337759","50324501231826789160309840540062699582","237600475723482905836895182920741024271","234484405130511569076714754633179401773","105427670492930361006516195268957660731","143229091783369377950465180588257894375","58406200006327456834217382734249525956","159047662255772916035361968244877418016","35180091316272223097213034150472977047","196145488914074019479235612975070765329","328477181358208825362340145259055900041","73185503361627566878888113404923428856","161837083178008026165667893933912241392","140291662063997200928946091320824199391","319998436516802551091498088607948292344","21610776523271579580951516579849670828","334258895799137905571381332014549593781","285602280981664444887378475610782202957","306217516614748796354486466595327591516"]},"deprecated":false,"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/44bde2521638b0e071f65e9da664d8c274786741","signature_type":"Line","target":{"file":"core/java/android/app/NotificationChannel.java"},"id":"ASB-A-481967442-30a44a1e"},{"id":"ASB-A-481967442-ba9338f3","source":"https://android.googlesource.com/platform/frameworks/base/+/44bde2521638b0e071f65e9da664d8c274786741","signature_version":"v1","deprecated":false,"signature_type":"Function","target":{"file":"core/java/android/app/NotificationChannel.java","function":"writeXml"},"digest":{"length":2957,"function_hash":"259308048496297022908965593157989218270"}},{"deprecated":false,"id":"ASB-A-481967442-ff59c97e","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/44bde2521638b0e071f65e9da664d8c274786741","signature_type":"Function","target":{"file":"core/java/android/app/NotificationChannel.java","function":"NotificationChannel"},"digest":{"function_hash":"190092132057378496538523398227059698467","length":2251}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/44bde2521638b0e071f65e9da664d8c274786741"],"severity":"High","types":["EoP"],"spl":"2026-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-481967442.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-06-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Line","id":"ASB-A-481967442-2121666b","digest":{"threshold":0.9,"line_hashes":["165244540637924401557640048652757763552","257736362510135360840653774735413042773","146129595386038721990984551099174763672","301952237391073482720007218921354080867","71573022188803360753771561952034869011","180106432130842263329597154305917452391","293322401576095725964532517829214158258","70810745183744949730094622808483430570","254115555012421027529185926390220626317","269491136932058675794174344396066394850","309289096885961521629619510083029120887","292278566044345597001780785120999711724","23558343870398825914313614032097122443","196145488914074019479235612975070765329","328477181358208825362340145259055900041","73185503361627566878888113404923428856","274188296471766135728195273722346189842","95351127904209469975589963375414970799","19199824950961330517172029516460358297","249446470169117098854071570937439734209","334258895799137905571381332014549593781","285602280981664444887378475610782202957","306217516614748796354486466595327591516"]},"deprecated":false,"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/23ec1f241d82da30835f3e4c3f0eefb6e2cb265f","target":{"file":"core/java/android/app/NotificationChannel.java"},"match_only_versions":["16-qpr2"]},{"id":"ASB-A-481967442-6f6a6ef4","source":"https://android.googlesource.com/platform/frameworks/base/+/23ec1f241d82da30835f3e4c3f0eefb6e2cb265f","signature_version":"v1","deprecated":false,"signature_type":"Function","target":{"file":"core/java/android/app/NotificationChannel.java","function":"writeXml"},"digest":{"function_hash":"20873914928737980341056725662531984103","length":2923}},{"id":"ASB-A-481967442-cb225e69","source":"https://android.googlesource.com/platform/frameworks/base/+/23ec1f241d82da30835f3e4c3f0eefb6e2cb265f","signature_version":"v1","deprecated":false,"signature_type":"Function","target":{"file":"core/java/android/app/NotificationChannel.java","function":"NotificationChannel"},"digest":{"function_hash":"261744550140028090282411973553245923566","length":2081}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/23ec1f241d82da30835f3e4c3f0eefb6e2cb265f"],"spl":"2026-06-01","types":["EoP"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-481967442.json"}}],"schema_version":"1.7.5"}