{"id":"ASB-A-486597445","details":"In validate_camera_metadata_structure of camera_metadata.c, there is a possible out of bounds write due to a logical error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-486597445","CVE-2026-28583"],"modified":"2026-09-10T15:43:18.983809180Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/system/media","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"target":{"file":"camera/src/camera_metadata.c","function":"validate_camera_metadata_structure"},"deprecated":false,"digest":{"function_hash":"5918764072479059676640111875850722165","length":5321},"id":"ASB-A-486597445-47433f49","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/media/+/930c247918143f812a9ccb0b682dcacf482e44ec"},{"digest":{"line_hashes":["329620967212854994364246168599582176983","4106660157000418053731843117038537320","44437520190302250187711447748343406210","251378026580360390263151524365380176154","162450243867775141873426425193185584348","77410920951435525971679091286833379848","80558133621988766327908356369581467993","327617428737142054020591997344268682731","186731668586943597024057224846660517313","142833096739549443239652049442680748850","301270569148098403882200049956629069407","158285845521498925031906006833059688772","203607992548179080765690731732201283097","162525106367962540017730306422167958122","121619409746371532584044538233210351317","264919417826360219125746574921252340782","290442059767905159029074998846529464391","339829099830322923079622973986450176939"],"threshold":0.9},"id":"ASB-A-486597445-e6dfe479","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/media/+/930c247918143f812a9ccb0b682dcacf482e44ec","target":{"file":"camera/src/camera_metadata.c"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/system/media/+/930c247918143f812a9ccb0b682dcacf482e44ec"],"severity":"High","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-486597445.json"}},{"package":{"name":"platform/system/media","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"digest":{"line_hashes":["329620967212854994364246168599582176983","4106660157000418053731843117038537320","44437520190302250187711447748343406210","251378026580360390263151524365380176154","162450243867775141873426425193185584348","77410920951435525971679091286833379848","80558133621988766327908356369581467993","327617428737142054020591997344268682731","186731668586943597024057224846660517313","142833096739549443239652049442680748850","301270569148098403882200049956629069407","158285845521498925031906006833059688772","203607992548179080765690731732201283097","162525106367962540017730306422167958122","121619409746371532584044538233210351317","264919417826360219125746574921252340782","290442059767905159029074998846529464391","339829099830322923079622973986450176939"],"threshold":0.9},"id":"ASB-A-486597445-46bd1fe5","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/media/+/2bf26265f025cd33253ec0f115ca48d21d14d083","target":{"file":"camera/src/camera_metadata.c"},"deprecated":false},{"digest":{"function_hash":"5918764072479059676640111875850722165","length":5321},"id":"ASB-A-486597445-7a185072","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/media/+/2bf26265f025cd33253ec0f115ca48d21d14d083","target":{"function":"validate_camera_metadata_structure","file":"camera/src/camera_metadata.c"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/system/media/+/2bf26265f025cd33253ec0f115ca48d21d14d083"],"severity":"High","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-486597445.json"}},{"package":{"name":"platform/system/media","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/media/+/6d526cb2075ba315d5ea91679c3f2e1d1416d5c7"],"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-486597445-1a0e5bad","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/media/+/6d526cb2075ba315d5ea91679c3f2e1d1416d5c7","target":{"file":"camera/src/camera_metadata.c"},"deprecated":false,"digest":{"line_hashes":["329620967212854994364246168599582176983","4106660157000418053731843117038537320","44437520190302250187711447748343406210","251378026580360390263151524365380176154","162450243867775141873426425193185584348","77410920951435525971679091286833379848","80558133621988766327908356369581467993","327617428737142054020591997344268682731","186731668586943597024057224846660517313","142833096739549443239652049442680748850","301270569148098403882200049956629069407","158285845521498925031906006833059688772","203607992548179080765690731732201283097","162525106367962540017730306422167958122","121619409746371532584044538233210351317","264919417826360219125746574921252340782","290442059767905159029074998846529464391","339829099830322923079622973986450176939"],"threshold":0.9}},{"id":"ASB-A-486597445-66e88ba9","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/media/+/6d526cb2075ba315d5ea91679c3f2e1d1416d5c7","target":{"file":"camera/src/camera_metadata.c","function":"validate_camera_metadata_structure"},"deprecated":false,"digest":{"function_hash":"5918764072479059676640111875850722165","length":5321}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-486597445.json"}},{"package":{"name":"platform/system/media","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-486597445-6115ea59","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/media/+/8f10bf58b6fadf5bdb05fc83d777ab11db3abb8c","target":{"file":"camera/src/camera_metadata.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["329620967212854994364246168599582176983","4106660157000418053731843117038537320","44437520190302250187711447748343406210","251378026580360390263151524365380176154","162450243867775141873426425193185584348","77410920951435525971679091286833379848","80558133621988766327908356369581467993","327617428737142054020591997344268682731","186731668586943597024057224846660517313","142833096739549443239652049442680748850","301270569148098403882200049956629069407","158285845521498925031906006833059688772","203607992548179080765690731732201283097","162525106367962540017730306422167958122","121619409746371532584044538233210351317","264919417826360219125746574921252340782","290442059767905159029074998846529464391","339829099830322923079622973986450176939"]}},{"source":"https://android.googlesource.com/platform/system/media/+/8f10bf58b6fadf5bdb05fc83d777ab11db3abb8c","target":{"file":"camera/src/camera_metadata.c","function":"validate_camera_metadata_structure"},"deprecated":false,"digest":{"function_hash":"5918764072479059676640111875850722165","length":5321},"id":"ASB-A-486597445-f32b3ac1","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/system/media/+/8f10bf58b6fadf5bdb05fc83d777ab11db3abb8c"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-486597445.json"}},{"package":{"name":"platform/system/media","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-09-01"}]}],"versions":["14"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"digest":{"line_hashes":["329620967212854994364246168599582176983","4106660157000418053731843117038537320","44437520190302250187711447748343406210","251378026580360390263151524365380176154","162450243867775141873426425193185584348","77410920951435525971679091286833379848","80558133621988766327908356369581467993","327617428737142054020591997344268682731","186731668586943597024057224846660517313","142833096739549443239652049442680748850","301270569148098403882200049956629069407","158285845521498925031906006833059688772","203607992548179080765690731732201283097","162525106367962540017730306422167958122","121619409746371532584044538233210351317","264919417826360219125746574921252340782","290442059767905159029074998846529464391","339829099830322923079622973986450176939"],"threshold":0.9},"id":"ASB-A-486597445-8bf1c929","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/media/+/7e1583979033af1b23498e65c053011911cd94c2","target":{"file":"camera/src/camera_metadata.c"},"deprecated":false},{"source":"https://android.googlesource.com/platform/system/media/+/7e1583979033af1b23498e65c053011911cd94c2","target":{"file":"camera/src/camera_metadata.c","function":"validate_camera_metadata_structure"},"deprecated":false,"digest":{"length":5321,"function_hash":"5918764072479059676640111875850722165"},"id":"ASB-A-486597445-bed978c8","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/system/media/+/7e1583979033af1b23498e65c053011911cd94c2"],"severity":"High","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-486597445.json"}}],"schema_version":"1.9.0"}