{"id":"ASB-A-485377744","details":"In read of MatroskaExtractor.cpp, there is a possible out-of-bounds write due to improper casting. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-485377744","CVE-2026-28609"],"modified":"2026-09-09T15:15:54.249544283Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"types":["RCE"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/11fab348d2f19f961aa5f77ebd982302b1c6fb97","target":{"function":"MatroskaSource::read","file":"media/module/extractors/mkv/MatroskaExtractor.cpp"},"deprecated":false,"digest":{"function_hash":"130309124943095167992892561007649601929","length":3382},"id":"ASB-A-485377744-5e2b9f64","match_only_versions":["17-next"]},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/11fab348d2f19f961aa5f77ebd982302b1c6fb97","target":{"file":"media/module/extractors/mkv/MatroskaExtractor.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["140625882455802095473998649509075544909","152176519520389055099570309723006715530","282407496075505354279707914805690913101","300713635019519034519916956871977702490","99336833860655455306008330526130631718","230277543580148863041176000085537438870","111158476575025450042098193687808676781"]},"id":"ASB-A-485377744-8e3a4df4","match_only_versions":["17-next"],"signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/11fab348d2f19f961aa5f77ebd982302b1c6fb97"],"severity":"High","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-485377744.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/av/+/4e120822e71e91de33849fa6e85df1d9321d3671","target":{"file":"media/module/extractors/mkv/MatroskaExtractor.cpp","function":"MatroskaSource::read"},"deprecated":false,"digest":{"length":3382,"function_hash":"130309124943095167992892561007649601929"},"id":"ASB-A-485377744-a736ee6a","match_only_versions":["15"],"signature_type":"Function","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/frameworks/av/+/4e120822e71e91de33849fa6e85df1d9321d3671","target":{"file":"media/module/extractors/mkv/MatroskaExtractor.cpp"},"deprecated":false,"digest":{"line_hashes":["140625882455802095473998649509075544909","152176519520389055099570309723006715530","282407496075505354279707914805690913101","300713635019519034519916956871977702490","99336833860655455306008330526130631718","230277543580148863041176000085537438870","111158476575025450042098193687808676781"],"threshold":0.9},"id":"ASB-A-485377744-d1cb8e7e","match_only_versions":["15"],"signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/4e120822e71e91de33849fa6e85df1d9321d3671"],"severity":"High","spl":"2026-09-01","types":["RCE"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-485377744.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["RCE"],"vanir_signatures":[{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["140625882455802095473998649509075544909","152176519520389055099570309723006715530","282407496075505354279707914805690913101","300713635019519034519916956871977702490","99336833860655455306008330526130631718","230277543580148863041176000085537438870","111158476575025450042098193687808676781"]},"id":"ASB-A-485377744-5142c48b","match_only_versions":["16"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/a4955af6dee107f449137db905e6817c10a76610","target":{"file":"media/module/extractors/mkv/MatroskaExtractor.cpp"}},{"digest":{"function_hash":"130309124943095167992892561007649601929","length":3382},"id":"ASB-A-485377744-647ef61d","match_only_versions":["16"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/a4955af6dee107f449137db905e6817c10a76610","target":{"file":"media/module/extractors/mkv/MatroskaExtractor.cpp","function":"MatroskaSource::read"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/a4955af6dee107f449137db905e6817c10a76610"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-485377744.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"vanir_signatures":[{"digest":{"length":3382,"function_hash":"130309124943095167992892561007649601929"},"id":"ASB-A-485377744-15199eb4","match_only_versions":["16-qpr2"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/22f16d4f8514ce82c618e69cfb323931ffbd362e","target":{"file":"media/module/extractors/mkv/MatroskaExtractor.cpp","function":"MatroskaSource::read"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/22f16d4f8514ce82c618e69cfb323931ffbd362e","target":{"file":"media/module/extractors/mkv/MatroskaExtractor.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["140625882455802095473998649509075544909","152176519520389055099570309723006715530","282407496075505354279707914805690913101","300713635019519034519916956871977702490","99336833860655455306008330526130631718","230277543580148863041176000085537438870","111158476575025450042098193687808676781"]},"id":"ASB-A-485377744-b81dd4dc","match_only_versions":["16-qpr2"]}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/22f16d4f8514ce82c618e69cfb323931ffbd362e"],"severity":"High","spl":"2026-09-01","types":["RCE"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-485377744.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-09-01"}]}],"versions":["14"],"ecosystem_specific":{"types":["RCE"],"vanir_signatures":[{"match_only_versions":["14"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/1415c9197362583134d90580ce7c37c2020089d7","target":{"file":"media/module/extractors/mkv/MatroskaExtractor.cpp","function":"MatroskaSource::read"},"deprecated":false,"digest":{"function_hash":"130309124943095167992892561007649601929","length":3382},"id":"ASB-A-485377744-18c6651e"},{"match_only_versions":["14"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/1415c9197362583134d90580ce7c37c2020089d7","target":{"file":"media/module/extractors/mkv/MatroskaExtractor.cpp"},"deprecated":false,"digest":{"line_hashes":["140625882455802095473998649509075544909","152176519520389055099570309723006715530","282407496075505354279707914805690913101","300713635019519034519916956871977702490","99336833860655455306008330526130631718","230277543580148863041176000085537438870","111158476575025450042098193687808676781"],"threshold":0.9},"id":"ASB-A-485377744-da3fbcad"}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/1415c9197362583134d90580ce7c37c2020089d7"],"severity":"High","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-485377744.json"}}],"schema_version":"1.9.0"}