{"id":"ASB-A-503542587","details":"In tt_var_load_item_variation_store of ttgxvar.c, there is a possible out of bounds read due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-503542587","CVE-2026-45516"],"modified":"2026-10-05T16:41:13.153912645Z","published":"2026-10-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-10-01"}],"affected":[{"package":{"name":"platform/external/freetype","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-10-01"}]}],"versions":["17-next"],"ecosystem_specific":{"types":["ID"],"vanir_signatures":[{"target":{"file":"src/truetype/ttgxvar.c","function":"tt_var_load_item_variation_store"},"deprecated":false,"digest":{"length":4105,"function_hash":"318343513261514701969980884356396947578"},"id":"ASB-A-503542587-55584080","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/freetype/+/46c63346c59373e48e015ee2383f2f8ff5f90232"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/freetype/+/46c63346c59373e48e015ee2383f2f8ff5f90232","target":{"file":"src/truetype/ttgxvar.c"},"deprecated":false,"digest":{"line_hashes":["173775725118845386785921971932501480943","217990528756814337641523475873168464252","256299278966677633404315659859596614456","131613146236841817417653859910863912020","64709015543735491674836162189416750751","31847057092482650765499423577043743340","77677376389532582855417806035044380397","251390016063463307935723584293454852956"],"threshold":0.9},"id":"ASB-A-503542587-864f71d3"}],"fixes":["https://android.googlesource.com/platform/external/freetype/+/46c63346c59373e48e015ee2383f2f8ff5f90232"],"severity":"High","spl":"2026-10-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503542587.json"}},{"package":{"name":"platform/external/freetype","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-10-01"}]}],"versions":["15"],"ecosystem_specific":{"severity":"High","spl":"2026-10-01","types":["ID"],"vanir_signatures":[{"target":{"file":"src/truetype/ttgxvar.c","function":"tt_var_load_item_variation_store"},"deprecated":false,"digest":{"length":3479,"function_hash":"208113738213926568347286287092880860289"},"id":"ASB-A-503542587-97c5f84f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/freetype/+/68c9652af5e4c4764c8803235b288b4f6fce8cf9"},{"source":"https://android.googlesource.com/platform/external/freetype/+/68c9652af5e4c4764c8803235b288b4f6fce8cf9","target":{"file":"src/truetype/ttgxvar.c"},"deprecated":false,"digest":{"line_hashes":["173775725118845386785921971932501480943","217990528756814337641523475873168464252","256299278966677633404315659859596614456","131613146236841817417653859910863912020","64709015543735491674836162189416750751","31847057092482650765499423577043743340","77677376389532582855417806035044380397","251390016063463307935723584293454852956"],"threshold":0.9},"id":"ASB-A-503542587-98034925","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/external/freetype/+/68c9652af5e4c4764c8803235b288b4f6fce8cf9"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503542587.json"}},{"package":{"name":"platform/external/freetype","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-10-01"}]}],"versions":["16"],"ecosystem_specific":{"spl":"2026-10-01","types":["ID"],"vanir_signatures":[{"target":{"function":"tt_var_load_item_variation_store","file":"src/truetype/ttgxvar.c"},"deprecated":false,"digest":{"function_hash":"208113738213926568347286287092880860289","length":3479},"id":"ASB-A-503542587-04b7c44f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/freetype/+/9a879fc426c80c832ca5e1bc02704648e78c29b7"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/external/freetype/+/9a879fc426c80c832ca5e1bc02704648e78c29b7","target":{"file":"src/truetype/ttgxvar.c"},"deprecated":false,"digest":{"line_hashes":["173775725118845386785921971932501480943","217990528756814337641523475873168464252","256299278966677633404315659859596614456","131613146236841817417653859910863912020","64709015543735491674836162189416750751","31847057092482650765499423577043743340","77677376389532582855417806035044380397","251390016063463307935723584293454852956"],"threshold":0.9},"id":"ASB-A-503542587-35ea4a9f","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/external/freetype/+/9a879fc426c80c832ca5e1bc02704648e78c29b7"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503542587.json"}},{"package":{"name":"platform/external/freetype","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-10-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/freetype/+/d940b83d2fce8b2c87a6f1b9fb628c23a4b46548","target":{"file":"src/truetype/ttgxvar.c"},"deprecated":false,"digest":{"line_hashes":["173775725118845386785921971932501480943","217990528756814337641523475873168464252","256299278966677633404315659859596614456","131613146236841817417653859910863912020","64709015543735491674836162189416750751","31847057092482650765499423577043743340","77677376389532582855417806035044380397","251390016063463307935723584293454852956"],"threshold":0.9},"id":"ASB-A-503542587-c94c8a8d"},{"target":{"function":"tt_var_load_item_variation_store","file":"src/truetype/ttgxvar.c"},"deprecated":false,"digest":{"length":4105,"function_hash":"318343513261514701969980884356396947578"},"id":"ASB-A-503542587-f61c6e80","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/freetype/+/d940b83d2fce8b2c87a6f1b9fb628c23a4b46548"}],"fixes":["https://android.googlesource.com/platform/external/freetype/+/d940b83d2fce8b2c87a6f1b9fb628c23a4b46548"],"severity":"High","spl":"2026-10-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503542587.json"}},{"package":{"name":"platform/external/freetype","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-10-01"}]}],"versions":["17"],"ecosystem_specific":{"severity":"High","spl":"2026-10-01","types":["ID"],"vanir_signatures":[{"id":"ASB-A-503542587-3f36209c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/freetype/+/e6bcebe7f6e01c36fd7334d31eb0fa531e822ee9","target":{"function":"tt_var_load_item_variation_store","file":"src/truetype/ttgxvar.c"},"deprecated":false,"digest":{"function_hash":"318343513261514701969980884356396947578","length":4105}},{"id":"ASB-A-503542587-58186162","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/freetype/+/e6bcebe7f6e01c36fd7334d31eb0fa531e822ee9","target":{"file":"src/truetype/ttgxvar.c"},"deprecated":false,"digest":{"line_hashes":["173775725118845386785921971932501480943","217990528756814337641523475873168464252","256299278966677633404315659859596614456","131613146236841817417653859910863912020","64709015543735491674836162189416750751","31847057092482650765499423577043743340","77677376389532582855417806035044380397","251390016063463307935723584293454852956"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/external/freetype/+/e6bcebe7f6e01c36fd7334d31eb0fa531e822ee9"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503542587.json"}}],"schema_version":"1.9.0"}