{"id":"ASB-A-501155244","details":"In serviceClassExists of InCallController.java, there is a possible arbitrary code execution due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-501155244","CVE-2026-49881"],"modified":"2026-09-09T15:15:54.249544283Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"types":["EoP"],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/0a9a3f2c534db1cf36e449bee4269c39ba7ab545"],"severity":"High","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-501155244.json"}},{"package":{"name":"platform/packages/services/Telecomm","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/48525b8b70bb855db9a9a1856a5218c6a7b344e9","target":{"file":"src/com/android/server/telecom/InCallController.java","function":"getInCallServiceComponents"},"deprecated":false,"digest":{"function_hash":"282658346841546096495384763041413561170","length":1861},"id":"ASB-A-501155244-39dfe756","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["82408631832986729637817279161616402642","120518000033049452190543332623194213363","33880551372729546140855649246302399483","45528890950874715875803088761880087414","26111947286542806525162583905561471358","60306612980312160228312411663171282463","304182585061558789212811414233294013696","267292320656752398204916726255939830037","218440445332378168585893985239084804591","170547400531798818999252283675600478342","332669089175524362916613119678524252486","78889571470490266951138492441949069323","38745861802025732166847001254971420777","228357309032777343343163409535836374633","294792022055113896344419598708467203872","317436012638809835890466611273954843463","32837644037894757913911099992823265440","137428068868162681341237701674380715335","3365132896627164458620075607053049792","35110418466199334784605689656200076449","59352760030732041799449454056967980269","104605819822342410418784542424690525756","213142437314445321581823903602972118242","32498864633287206798622066599198091016","253318201686852287316287269916961607875","155216916043286441901122250688240820244","226021362067563941452739442577862042950","207096949481375466813040673099745065745","71986537064158586011231428922065879273"]},"id":"ASB-A-501155244-44d5ee5e","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/48525b8b70bb855db9a9a1856a5218c6a7b344e9","target":{"file":"src/com/android/server/telecom/InCallController.java"}},{"source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/48525b8b70bb855db9a9a1856a5218c6a7b344e9","target":{"file":"src/com/android/server/telecom/InCallController.java","function":"serviceClassExists"},"deprecated":false,"digest":{"function_hash":"84194250992961365504171744068490628156","length":651},"id":"ASB-A-501155244-c78a4bf3","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/services/Telecomm/+/48525b8b70bb855db9a9a1856a5218c6a7b344e9"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-501155244.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["EoP"],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/caa9d5b8040a75b083fabd7fbe44d0e1645ba1c8"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-501155244.json"}},{"package":{"name":"platform/packages/services/Telecomm","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/e38fb9ae5507340a87934530ef9c26d6c55c57ba","target":{"file":"src/com/android/server/telecom/InCallController.java","function":"serviceClassExists"},"deprecated":false,"digest":{"length":651,"function_hash":"84194250992961365504171744068490628156"},"id":"ASB-A-501155244-33372827","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"282658346841546096495384763041413561170","length":1861},"id":"ASB-A-501155244-dfc262c8","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/e38fb9ae5507340a87934530ef9c26d6c55c57ba","target":{"file":"src/com/android/server/telecom/InCallController.java","function":"getInCallServiceComponents"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["82408631832986729637817279161616402642","120518000033049452190543332623194213363","33880551372729546140855649246302399483","45528890950874715875803088761880087414","26111947286542806525162583905561471358","60306612980312160228312411663171282463","304182585061558789212811414233294013696","267292320656752398204916726255939830037","218440445332378168585893985239084804591","170547400531798818999252283675600478342","332669089175524362916613119678524252486","78889571470490266951138492441949069323","38745861802025732166847001254971420777","228357309032777343343163409535836374633","294792022055113896344419598708467203872","317436012638809835890466611273954843463","32837644037894757913911099992823265440","137428068868162681341237701674380715335","3365132896627164458620075607053049792","35110418466199334784605689656200076449","59352760030732041799449454056967980269","104605819822342410418784542424690525756","213142437314445321581823903602972118242","32498864633287206798622066599198091016","253318201686852287316287269916961607875","155216916043286441901122250688240820244","226021362067563941452739442577862042950","207096949481375466813040673099745065745","71986537064158586011231428922065879273"],"threshold":0.9},"id":"ASB-A-501155244-f7c85754","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/e38fb9ae5507340a87934530ef9c26d6c55c57ba","target":{"file":"src/com/android/server/telecom/InCallController.java"}}],"fixes":["https://android.googlesource.com/platform/packages/services/Telecomm/+/e38fb9ae5507340a87934530ef9c26d6c55c57ba"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-501155244.json"}}],"schema_version":"1.9.0"}