{"id":"ASB-A-498720726","details":"In multiple locations, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-498720726","CVE-2026-28594"],"modified":"2026-09-09T15:15:54.249544283Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/daf86f667f9d8922af019155f8a672cca88c6f71","target":{"function":"android_util_MemoryIntArray_open","file":"core/jni/android_util_MemoryIntArray.cpp"},"deprecated":false,"digest":{"length":1161,"function_hash":"76900263193821131613803144858038446815"},"id":"ASB-A-498720726-1021c921","match_only_versions":["17-next"]},{"digest":{"function_hash":"131701758285787395297905332457470791737","length":355},"id":"ASB-A-498720726-29681208","match_only_versions":["17-next"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/daf86f667f9d8922af019155f8a672cca88c6f71","target":{"function":"MemoryIntArray","file":"core/java/android/util/MemoryIntArray.java"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/daf86f667f9d8922af019155f8a672cca88c6f71","target":{"function":"android_util_MemoryIntArray_create","file":"core/jni/android_util_MemoryIntArray.cpp"},"deprecated":false,"digest":{"function_hash":"54008343303569645723833411385589645739","length":765},"id":"ASB-A-498720726-47b62007","match_only_versions":["17-next"],"signature_type":"Function"},{"digest":{"line_hashes":["291922031398692510497560056864533368952","227506297400933504963646301717120503104","104638150338775150101656333873490316177","107480972324893069453549329433513446698","136445929339844975200811835264935636489","242464893937605967049964177092723965229","9412631001575639785114500168280286836","320528159802038150585474044698579747756","335832926160292829086306275655036011655","96245542921365624695362216522992334683"],"threshold":0.9},"id":"ASB-A-498720726-752c7ec6","match_only_versions":["17-next"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/daf86f667f9d8922af019155f8a672cca88c6f71","target":{"file":"core/tests/utiltests/jni/registration.cpp"},"deprecated":false},{"digest":{"line_hashes":["152815109277170133695153505211749735658","155044243200771554719303149137651472707","208511731064627399958747115307265737133","7531244446045422166020472046957915986","217199346926436915797355971599916226771","180502946815144274557173276854138514432","231620737672136973603056563070047038213","68081413217840510718011349453948719638","150202046933768071157777637458122373137","18056015648009628007615971470510765625","122405822305269018493445926114987952611","231620737672136973603056563070047038213","214246854821834111154135886698317198582","145020545018180516325726880534416301950","178406821604928443969524244160203848439","258191090984401892040679504607555474622","123756796487934467035933598340554439383","149855342357537560890122607809656368851","208340516746309916234459030526445352469","5645389750264270427721531489413298243","187239258287230248717499559141092282117","336916498327133487779821517935655388731"],"threshold":0.9},"id":"ASB-A-498720726-8d153353","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/daf86f667f9d8922af019155f8a672cca88c6f71","target":{"file":"core/java/android/util/MemoryIntArray.java"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/daf86f667f9d8922af019155f8a672cca88c6f71","target":{"function":"android_util_MemoryIntArray_close","file":"core/jni/android_util_MemoryIntArray.cpp"},"deprecated":false,"digest":{"function_hash":"38166435893550139268687204945826879693","length":565},"id":"ASB-A-498720726-9928d119","signature_type":"Function"},{"id":"ASB-A-498720726-9a60a654","match_only_versions":["17-next"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/daf86f667f9d8922af019155f8a672cca88c6f71","target":{"file":"core/jni/android_util_MemoryIntArray.cpp","function":"android_util_MemoryIntArray_size"},"deprecated":false,"digest":{"function_hash":"174779443649482355402812409544076413984","length":386}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/daf86f667f9d8922af019155f8a672cca88c6f71","target":{"function":"MemoryIntArray","file":"core/java/android/util/MemoryIntArray.java"},"deprecated":false,"digest":{"length":346,"function_hash":"248509001113494497336422510635248940189"},"id":"ASB-A-498720726-a4f48509","match_only_versions":["17-next"],"signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/daf86f667f9d8922af019155f8a672cca88c6f71","target":{"function":"close","file":"core/java/android/util/MemoryIntArray.java"},"deprecated":false,"digest":{"function_hash":"27729224489676775308724795026202759707","length":141},"id":"ASB-A-498720726-ea33a7ae","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/daf86f667f9d8922af019155f8a672cca88c6f71","target":{"file":"core/jni/android_util_MemoryIntArray.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["311811326995784262900725300333338938267","240736600444888457353209709794480217054","58089579335046525064191414007314326716","204484563079203397550973469818208086778","238310551684556503738917843574333596131","195861596220917129249635877703978886291","299099740268635222488232310788876240013","14059129678279052728588938558666256695","220203372314011995781013863888168900573","134069253562633038573050742371654051399","337944621513963730967243117885625310391","101058603297410948177699007007988580526","32922156444162708257741505061568619686","156858808719786810417049322123269990147","306114047834057060657819930428296966803","159520141018659611442291465916451546211","137669828787957745782993742012303206367","311711192902333379256457748338265388856","254808117467127051497503912293764907265","184013063584249746995358584091604296239","234791026868904197269105805435512544749","41662073655321480079009449172789350285","163533690022180619795790641261917938514","140139006821557093181572162454224419262","176132557022473757585193781553631770908","81718571384538978944973511953000005179","195209324845594445471998838001339384798","45940792907980987070707038998959379431","159520141018659611442291465916451546211","144876369797070497723855306680629882482","86557364217833776852929471661899946110","238707739712339597154474992204293910681","132241855419767745929843832054270210463","187299110898556200123727065453998874846","156727147963386350366449290037760500296","209571206259975371020523558334951542284","288450508006988723224801985988920219356","46582513359544985551230770308964004066","289401712196183531448332484052858386028"]},"id":"ASB-A-498720726-f976d6b1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/daf86f667f9d8922af019155f8a672cca88c6f71"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-498720726.json"}},{"package":{"name":"platform/system/core","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/core/+/a580fc27e6b7c2671932de0f5d8ad9701b294385","https://android.googlesource.com/platform/system/core/+/5ceaa348e48cb98a0e69c8771f1bd57b818484ba"],"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["51864448609087483291833739809251800346","54249544875072714184090895650188953976","303931456850462550863377332666616362383","48544250685677423603873946627292517014"],"threshold":0.9},"id":"ASB-A-498720726-b0a9a9a3","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/core/+/a580fc27e6b7c2671932de0f5d8ad9701b294385","target":{"file":"libcutils/ashmem-dev.cpp"}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/core/+/a580fc27e6b7c2671932de0f5d8ad9701b294385","target":{"function":"is_memfd_fd","file":"libcutils/ashmem-dev.cpp"},"deprecated":false,"digest":{"length":302,"function_hash":"294614984570886117998757781952533473446"},"id":"ASB-A-498720726-f065493f"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-498720726.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/cd59384e8abf79ba2500521a9ca1bfe8712bd058","target":{"file":"core/jni/android_util_MemoryIntArray.cpp","function":"android_util_MemoryIntArray_size"},"deprecated":false,"digest":{"length":386,"function_hash":"174779443649482355402812409544076413984"},"id":"ASB-A-498720726-15122ac3","match_only_versions":["16-qpr2"],"signature_type":"Function","signature_version":"v1"},{"digest":{"length":152,"function_hash":"258370251725014200354979439969542612271"},"id":"ASB-A-498720726-2814558b","match_only_versions":["16-qpr2"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/cd59384e8abf79ba2500521a9ca1bfe8712bd058","target":{"file":"core/java/android/util/MemoryIntArray.java","function":"close"},"deprecated":false},{"match_only_versions":["16-qpr2"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/cd59384e8abf79ba2500521a9ca1bfe8712bd058","target":{"function":"android_util_MemoryIntArray_open","file":"core/jni/android_util_MemoryIntArray.cpp"},"deprecated":false,"digest":{"length":1161,"function_hash":"76900263193821131613803144858038446815"},"id":"ASB-A-498720726-5143afc7"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/cd59384e8abf79ba2500521a9ca1bfe8712bd058","target":{"function":"MemoryIntArray","file":"core/java/android/util/MemoryIntArray.java"},"deprecated":false,"digest":{"function_hash":"248509001113494497336422510635248940189","length":346},"id":"ASB-A-498720726-5ae4cd41","match_only_versions":["16-qpr2"]},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/cd59384e8abf79ba2500521a9ca1bfe8712bd058","target":{"file":"core/jni/android_util_MemoryIntArray.cpp","function":"android_util_MemoryIntArray_close"},"deprecated":false,"digest":{"function_hash":"86907412614706650414672207661141222366","length":734},"id":"ASB-A-498720726-639500ea","match_only_versions":["16-qpr2"]},{"match_only_versions":["16-qpr2"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/cd59384e8abf79ba2500521a9ca1bfe8712bd058","target":{"file":"core/jni/android_util_MemoryIntArray.cpp"},"deprecated":false,"digest":{"line_hashes":["217981669874337348334468120438590560078","313899853530975773070210225059994386015","183114897519304616231303506308704474889","204484563079203397550973469818208086778","238310551684556503738917843574333596131","195861596220917129249635877703978886291","299099740268635222488232310788876240013","14059129678279052728588938558666256695","220203372314011995781013863888168900573","134069253562633038573050742371654051399","337944621513963730967243117885625310391","101058603297410948177699007007988580526","32922156444162708257741505061568619686","156858808719786810417049322123269990147","306114047834057060657819930428296966803","159520141018659611442291465916451546211","137669828787957745782993742012303206367","311711192902333379256457748338265388856","254808117467127051497503912293764907265","184013063584249746995358584091604296239","234791026868904197269105805435512544749","237399824082355171803806174453051408786","168866028214546303593812897752657471820","265727123508470120161816844928365339506","138358744177680671772556003696639989389","195209324845594445471998838001339384798","45940792907980987070707038998959379431","159520141018659611442291465916451546211","144876369797070497723855306680629882482","86557364217833776852929471661899946110","238707739712339597154474992204293910681","132241855419767745929843832054270210463","187299110898556200123727065453998874846","156727147963386350366449290037760500296","96861780103249433926832284597492581711","55031492406895493045355130587506714384","122046409545616616863161581740573453220","15047999727329752975758374416259142832"],"threshold":0.9},"id":"ASB-A-498720726-6a636053"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/cd59384e8abf79ba2500521a9ca1bfe8712bd058","target":{"function":"MemoryIntArray","file":"core/java/android/util/MemoryIntArray.java"},"deprecated":false,"digest":{"length":355,"function_hash":"131701758285787395297905332457470791737"},"id":"ASB-A-498720726-96be0a3a","match_only_versions":["16-qpr2"],"signature_type":"Function","signature_version":"v1"},{"match_only_versions":["16-qpr2"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/cd59384e8abf79ba2500521a9ca1bfe8712bd058","target":{"file":"core/java/android/util/MemoryIntArray.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["152815109277170133695153505211749735658","155044243200771554719303149137651472707","208511731064627399958747115307265737133","7531244446045422166020472046957915986","217199346926436915797355971599916226771","180502946815144274557173276854138514432","231620737672136973603056563070047038213","68081413217840510718011349453948719638","150202046933768071157777637458122373137","18056015648009628007615971470510765625","122405822305269018493445926114987952611","231620737672136973603056563070047038213","214246854821834111154135886698317198582","158617706979392150424008179447293565317","323663085141508824425948754104244052453","52435412407735527814054716598127462554","212598529887545182981902451735541018066","149855342357537560890122607809656368851","60922196011202981417148685765374097866","190899188725762232425487290901874453838","135513710757755156780476203163166331128","171968603838340288005503334105224416324"]},"id":"ASB-A-498720726-ab91f5cd"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/cd59384e8abf79ba2500521a9ca1bfe8712bd058","target":{"file":"core/tests/utiltests/jni/registration.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["291922031398692510497560056864533368952","227506297400933504963646301717120503104","104638150338775150101656333873490316177","107480972324893069453549329433513446698","136445929339844975200811835264935636489","242464893937605967049964177092723965229","9412631001575639785114500168280286836","320528159802038150585474044698579747756","335832926160292829086306275655036011655","96245542921365624695362216522992334683"]},"id":"ASB-A-498720726-cb17ea71","match_only_versions":["16-qpr2"],"signature_type":"Line"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/cd59384e8abf79ba2500521a9ca1bfe8712bd058","target":{"file":"core/jni/android_util_MemoryIntArray.cpp","function":"android_util_MemoryIntArray_create"},"deprecated":false,"digest":{"function_hash":"54008343303569645723833411385589645739","length":765},"id":"ASB-A-498720726-d0ab2e4f","match_only_versions":["16-qpr2"],"signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/cd59384e8abf79ba2500521a9ca1bfe8712bd058"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-498720726.json"}},{"package":{"name":"platform/system/core","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/core/+/4892c4587fe6e58e445d16b8675365e3030de0dc","target":{"file":"libcutils/ashmem-dev.cpp"},"deprecated":false,"digest":{"line_hashes":["51864448609087483291833739809251800346","54249544875072714184090895650188953976","303931456850462550863377332666616362383","48544250685677423603873946627292517014"],"threshold":0.9},"id":"ASB-A-498720726-2b211b68"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/core/+/4892c4587fe6e58e445d16b8675365e3030de0dc","target":{"file":"libcutils/ashmem-dev.cpp","function":"is_memfd_fd"},"deprecated":false,"digest":{"function_hash":"294614984570886117998757781952533473446","length":302},"id":"ASB-A-498720726-435e17c5","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/system/core/+/4892c4587fe6e58e445d16b8675365e3030de0dc","https://android.googlesource.com/platform/system/core/+/d97d77a6400ceab97a8acc55531e04424266fc01"],"severity":"High","spl":"2026-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-498720726.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/a44880c82aac2a343ae56ac65ccb349b08bdbc17"],"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a44880c82aac2a343ae56ac65ccb349b08bdbc17","target":{"file":"core/java/android/util/MemoryIntArray.java","function":"close"},"deprecated":false,"digest":{"length":141,"function_hash":"27729224489676775308724795026202759707"},"id":"ASB-A-498720726-16d812f8","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a44880c82aac2a343ae56ac65ccb349b08bdbc17","target":{"file":"core/jni/android_util_MemoryIntArray.cpp","function":"android_util_MemoryIntArray_create"},"deprecated":false,"digest":{"length":765,"function_hash":"54008343303569645723833411385589645739"},"id":"ASB-A-498720726-2229ac0d","match_only_versions":["17"],"signature_type":"Function"},{"digest":{"line_hashes":["291922031398692510497560056864533368952","227506297400933504963646301717120503104","104638150338775150101656333873490316177","107480972324893069453549329433513446698","136445929339844975200811835264935636489","242464893937605967049964177092723965229","9412631001575639785114500168280286836","320528159802038150585474044698579747756","335832926160292829086306275655036011655","96245542921365624695362216522992334683"],"threshold":0.9},"id":"ASB-A-498720726-506be119","match_only_versions":["17"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a44880c82aac2a343ae56ac65ccb349b08bdbc17","target":{"file":"core/tests/utiltests/jni/registration.cpp"},"deprecated":false},{"target":{"file":"core/java/android/util/MemoryIntArray.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["152815109277170133695153505211749735658","155044243200771554719303149137651472707","208511731064627399958747115307265737133","7531244446045422166020472046957915986","217199346926436915797355971599916226771","180502946815144274557173276854138514432","231620737672136973603056563070047038213","68081413217840510718011349453948719638","150202046933768071157777637458122373137","18056015648009628007615971470510765625","122405822305269018493445926114987952611","231620737672136973603056563070047038213","214246854821834111154135886698317198582","145020545018180516325726880534416301950","178406821604928443969524244160203848439","258191090984401892040679504607555474622","123756796487934467035933598340554439383","149855342357537560890122607809656368851","208340516746309916234459030526445352469","5645389750264270427721531489413298243","187239258287230248717499559141092282117","336916498327133487779821517935655388731"]},"id":"ASB-A-498720726-63287d54","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a44880c82aac2a343ae56ac65ccb349b08bdbc17"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/a44880c82aac2a343ae56ac65ccb349b08bdbc17","target":{"function":"MemoryIntArray","file":"core/java/android/util/MemoryIntArray.java"},"deprecated":false,"digest":{"function_hash":"248509001113494497336422510635248940189","length":346},"id":"ASB-A-498720726-652fd8ec","match_only_versions":["17"],"signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"38166435893550139268687204945826879693","length":565},"id":"ASB-A-498720726-714f9110","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a44880c82aac2a343ae56ac65ccb349b08bdbc17","target":{"file":"core/jni/android_util_MemoryIntArray.cpp","function":"android_util_MemoryIntArray_close"},"deprecated":false},{"match_only_versions":["17"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a44880c82aac2a343ae56ac65ccb349b08bdbc17","target":{"file":"core/jni/android_util_MemoryIntArray.cpp","function":"android_util_MemoryIntArray_size"},"deprecated":false,"digest":{"function_hash":"174779443649482355402812409544076413984","length":386},"id":"ASB-A-498720726-9aefe33c"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/a44880c82aac2a343ae56ac65ccb349b08bdbc17","target":{"file":"core/jni/android_util_MemoryIntArray.cpp","function":"android_util_MemoryIntArray_open"},"deprecated":false,"digest":{"length":1161,"function_hash":"76900263193821131613803144858038446815"},"id":"ASB-A-498720726-a86acd4a","match_only_versions":["17"],"signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a44880c82aac2a343ae56ac65ccb349b08bdbc17","target":{"file":"core/jni/android_util_MemoryIntArray.cpp"},"deprecated":false,"digest":{"line_hashes":["311811326995784262900725300333338938267","240736600444888457353209709794480217054","58089579335046525064191414007314326716","204484563079203397550973469818208086778","238310551684556503738917843574333596131","195861596220917129249635877703978886291","299099740268635222488232310788876240013","14059129678279052728588938558666256695","220203372314011995781013863888168900573","134069253562633038573050742371654051399","337944621513963730967243117885625310391","101058603297410948177699007007988580526","32922156444162708257741505061568619686","156858808719786810417049322123269990147","306114047834057060657819930428296966803","159520141018659611442291465916451546211","137669828787957745782993742012303206367","311711192902333379256457748338265388856","254808117467127051497503912293764907265","184013063584249746995358584091604296239","234791026868904197269105805435512544749","41662073655321480079009449172789350285","163533690022180619795790641261917938514","140139006821557093181572162454224419262","176132557022473757585193781553631770908","81718571384538978944973511953000005179","195209324845594445471998838001339384798","45940792907980987070707038998959379431","159520141018659611442291465916451546211","144876369797070497723855306680629882482","86557364217833776852929471661899946110","238707739712339597154474992204293910681","132241855419767745929843832054270210463","187299110898556200123727065453998874846","156727147963386350366449290037760500296","209571206259975371020523558334951542284","288450508006988723224801985988920219356","46582513359544985551230770308964004066","289401712196183531448332484052858386028"],"threshold":0.9},"id":"ASB-A-498720726-bf7bc3f0","signature_type":"Line"},{"digest":{"length":355,"function_hash":"131701758285787395297905332457470791737"},"id":"ASB-A-498720726-e9ce09c5","match_only_versions":["17"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a44880c82aac2a343ae56ac65ccb349b08bdbc17","target":{"file":"core/java/android/util/MemoryIntArray.java","function":"MemoryIntArray"},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-498720726.json"}},{"package":{"name":"platform/system/core","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"vanir_signatures":[{"digest":{"length":302,"function_hash":"294614984570886117998757781952533473446"},"id":"ASB-A-498720726-1e004a2d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/core/+/6297cab2c921135a98183a84e2b75ed4d74b910c","target":{"file":"libcutils/ashmem-dev.cpp","function":"is_memfd_fd"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/core/+/6297cab2c921135a98183a84e2b75ed4d74b910c","target":{"file":"libcutils/ashmem-dev.cpp"},"deprecated":false,"digest":{"line_hashes":["51864448609087483291833739809251800346","54249544875072714184090895650188953976","303931456850462550863377332666616362383","48544250685677423603873946627292517014"],"threshold":0.9},"id":"ASB-A-498720726-f49d4a78"}],"fixes":["https://android.googlesource.com/platform/system/core/+/6297cab2c921135a98183a84e2b75ed4d74b910c","https://android.googlesource.com/platform/system/core/+/2de25eeaec5500f0bfbc5d1ae320ca8c702e39f6"],"severity":"High","spl":"2026-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-498720726.json"}}],"schema_version":"1.9.0"}