{"id":"ASB-A-492492028","details":"In dec_frm_prepare of oapv.c, there is a possible OOB write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-492492028","CVE-2026-28618"],"modified":"2026-09-08T15:39:03.104189951Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/external/libopenapv","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"types":["RCE"],"vanir_signatures":[{"deprecated":false,"digest":{"length":1945,"function_hash":"188793983053057913566130712144412481575"},"id":"ASB-A-492492028-2f0355f2","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libopenapv/+/cf05ca54cffdb52567dbdc30ebc7eeff46b75e05","target":{"file":"src/oapv.c","function":"dec_frm_prepare"}},{"deprecated":false,"digest":{"line_hashes":["126164020771532226482616017431051074101","90942867543588952794674708670891517512","318380084858314903846906075165783976041","107665252290534563608069792544924973267"],"threshold":0.9},"id":"ASB-A-492492028-a252032d","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libopenapv/+/cf05ca54cffdb52567dbdc30ebc7eeff46b75e05","target":{"file":"src/oapv.c"}}],"fixes":["https://android.googlesource.com/platform/external/libopenapv/+/cf05ca54cffdb52567dbdc30ebc7eeff46b75e05"],"severity":"Critical","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-492492028.json"}},{"package":{"name":"platform/external/libopenapv","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/libopenapv/+/28622a8174204e332b17da89683a0385d7cda857"],"severity":"Critical","spl":"2026-09-01","types":["RCE"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libopenapv/+/28622a8174204e332b17da89683a0385d7cda857","target":{"file":"src/oapv.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["126164020771532226482616017431051074101","90942867543588952794674708670891517512","318380084858314903846906075165783976041","107665252290534563608069792544924973267"]},"id":"ASB-A-492492028-0096de5b"},{"source":"https://android.googlesource.com/platform/external/libopenapv/+/28622a8174204e332b17da89683a0385d7cda857","target":{"file":"src/oapv.c","function":"dec_frm_prepare"},"deprecated":false,"digest":{"function_hash":"188793983053057913566130712144412481575","length":1945},"id":"ASB-A-492492028-8960c499","signature_type":"Function","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-492492028.json"}},{"package":{"name":"platform/external/libopenapv","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"severity":"Critical","spl":"2026-09-01","types":["RCE"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/external/libopenapv/+/f0a82174285352296dce22c6190000ee47633244","target":{"file":"src/oapv.c","function":"dec_frm_prepare"},"deprecated":false,"digest":{"length":1945,"function_hash":"188793983053057913566130712144412481575"},"id":"ASB-A-492492028-0ac4cebb","signature_type":"Function","signature_version":"v1"},{"target":{"file":"src/oapv.c"},"deprecated":false,"digest":{"line_hashes":["126164020771532226482616017431051074101","90942867543588952794674708670891517512","318380084858314903846906075165783976041","107665252290534563608069792544924973267"],"threshold":0.9},"id":"ASB-A-492492028-eeb86936","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libopenapv/+/f0a82174285352296dce22c6190000ee47633244"}],"fixes":["https://android.googlesource.com/platform/external/libopenapv/+/f0a82174285352296dce22c6190000ee47633244"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-492492028.json"}},{"package":{"name":"platform/external/libopenapv","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"severity":"Critical","spl":"2026-09-01","types":["RCE"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/external/libopenapv/+/21d001689dd36663a1dfd93ce36f41114146affc","target":{"file":"src/oapv.c"},"deprecated":false,"digest":{"line_hashes":["126164020771532226482616017431051074101","90942867543588952794674708670891517512","318380084858314903846906075165783976041","107665252290534563608069792544924973267"],"threshold":0.9},"id":"ASB-A-492492028-0f2f9b4c","signature_type":"Line","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/external/libopenapv/+/21d001689dd36663a1dfd93ce36f41114146affc","target":{"function":"dec_frm_prepare","file":"src/oapv.c"},"deprecated":false,"digest":{"length":1945,"function_hash":"188793983053057913566130712144412481575"},"id":"ASB-A-492492028-746e73d0","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/external/libopenapv/+/21d001689dd36663a1dfd93ce36f41114146affc"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-492492028.json"}}],"schema_version":"1.9.0"}