{"id":"ASB-A-496454250","details":"In getSelectionBySubIds of ProviderUtil.java, there is a possible cross-user data leak due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-496454250","CVE-2026-58976"],"modified":"2026-11-02T17:11:09.687615106Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/packages/providers/TelephonyProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/14567ebd50eb068cb1e2b531a4f924440832ac5a"],"severity":"High","spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"id":"ASB-A-496454250-8a2ec798","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/14567ebd50eb068cb1e2b531a4f924440832ac5a","target":{"file":"src/com/android/providers/telephony/ProviderUtil.java"},"deprecated":false,"digest":{"line_hashes":["272509665014026114980560358686056544751","199189161198573969604473692238282238377","37994697227110651280769943569499720689","83361205433726812878618000842647868593","113154801669694426143828951838839056939","67893192979168687741649522275965851833","108981248413832129325679728130689691615","311106853950227969222065929936895528124","25610911969201805879596838300332522655"],"threshold":0.9}},{"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/14567ebd50eb068cb1e2b531a4f924440832ac5a","target":{"function":"getSelectionBySubIds","file":"src/com/android/providers/telephony/ProviderUtil.java"},"deprecated":false,"digest":{"function_hash":"225802028454404541150552831961267769994","length":1373},"id":"ASB-A-496454250-d9dc0a8f","signature_type":"Function","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-496454250.json"}},{"package":{"name":"platform/packages/providers/TelephonyProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/ca17ed10c9d48b192f193fdd5bd6e75bf0e8c433","target":{"file":"src/com/android/providers/telephony/ProviderUtil.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["272509665014026114980560358686056544751","199189161198573969604473692238282238377","37994697227110651280769943569499720689","83361205433726812878618000842647868593","113154801669694426143828951838839056939","67893192979168687741649522275965851833","108981248413832129325679728130689691615","311106853950227969222065929936895528124","25610911969201805879596838300332522655"]},"id":"ASB-A-496454250-555dc613","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/ca17ed10c9d48b192f193fdd5bd6e75bf0e8c433","target":{"function":"getSelectionBySubIds","file":"src/com/android/providers/telephony/ProviderUtil.java"},"deprecated":false,"digest":{"function_hash":"148401145251030299844321148441954354052","length":1289},"id":"ASB-A-496454250-583d1bbf"}],"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/ca17ed10c9d48b192f193fdd5bd6e75bf0e8c433"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-496454250.json"}},{"package":{"name":"platform/packages/providers/TelephonyProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"id":"ASB-A-496454250-3a85bb04","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/00b018673971434214d4b9a4b5acca06853c62e3","target":{"file":"src/com/android/providers/telephony/ProviderUtil.java"},"deprecated":false,"digest":{"line_hashes":["272509665014026114980560358686056544751","199189161198573969604473692238282238377","37994697227110651280769943569499720689","83361205433726812878618000842647868593","113154801669694426143828951838839056939","67893192979168687741649522275965851833","108981248413832129325679728130689691615","311106853950227969222065929936895528124","25610911969201805879596838300332522655"],"threshold":0.9}},{"digest":{"function_hash":"148401145251030299844321148441954354052","length":1289},"id":"ASB-A-496454250-4eb5218b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/00b018673971434214d4b9a4b5acca06853c62e3","target":{"function":"getSelectionBySubIds","file":"src/com/android/providers/telephony/ProviderUtil.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/00b018673971434214d4b9a4b5acca06853c62e3"],"severity":"High","spl":"2026-11-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-496454250.json"}},{"package":{"name":"platform/packages/providers/TelephonyProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"target":{"file":"src/com/android/providers/telephony/ProviderUtil.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["272509665014026114980560358686056544751","199189161198573969604473692238282238377","37994697227110651280769943569499720689","83361205433726812878618000842647868593","113154801669694426143828951838839056939","67893192979168687741649522275965851833","108981248413832129325679728130689691615","311106853950227969222065929936895528124","25610911969201805879596838300332522655"]},"id":"ASB-A-496454250-a5e4ed35","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/a5400b334de0643cac7931310ee18ff03657e536"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/a5400b334de0643cac7931310ee18ff03657e536","target":{"file":"src/com/android/providers/telephony/ProviderUtil.java","function":"getSelectionBySubIds"},"deprecated":false,"digest":{"length":1289,"function_hash":"148401145251030299844321148441954354052"},"id":"ASB-A-496454250-d0efab87","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/a5400b334de0643cac7931310ee18ff03657e536"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-496454250.json"}},{"package":{"name":"platform/packages/providers/TelephonyProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/6af54b00a2d48c4d49564a4058d045d3726c2628","target":{"function":"getSelectionBySubIds","file":"src/com/android/providers/telephony/ProviderUtil.java"},"deprecated":false,"digest":{"function_hash":"225802028454404541150552831961267769994","length":1373},"id":"ASB-A-496454250-c2cb1eb5"},{"id":"ASB-A-496454250-e70e26de","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/6af54b00a2d48c4d49564a4058d045d3726c2628","target":{"file":"src/com/android/providers/telephony/ProviderUtil.java"},"deprecated":false,"digest":{"line_hashes":["272509665014026114980560358686056544751","199189161198573969604473692238282238377","37994697227110651280769943569499720689","83361205433726812878618000842647868593","113154801669694426143828951838839056939","67893192979168687741649522275965851833","108981248413832129325679728130689691615","311106853950227969222065929936895528124","25610911969201805879596838300332522655"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/6af54b00a2d48c4d49564a4058d045d3726c2628"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-496454250.json"}}],"schema_version":"1.9.2"}