{"id":"ASB-A-503543341","details":"In multiple locations, there is a possible memory safety issue due to a use-after-free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-503543341","CVE-2026-58876"],"modified":"2026-11-02T17:11:10.530399974Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/external/aac","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"vanir_signatures":[{"target":{"file":"cpp/libSBRdec/src/sbrdecoder.cpp"},"deprecated":false,"digest":{"line_hashes":["153556380576910973068670790616142496210","135289179253646365718233578904619399164","92789277314867331282584572447910206592","210973425024332788952725228810583295016"],"threshold":0.9},"id":"ASB-A-503543341-2acc22a7","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/aac/+/731f21fc0465ed449f1ea4f2eeb1a2caa018d10f"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/aac/+/731f21fc0465ed449f1ea4f2eeb1a2caa018d10f","target":{"function":"CreatePsDec","file":"cpp/libSBRdec/src/psdec.cpp"},"deprecated":false,"digest":{"function_hash":"141344615261513171099177882799310373828","length":1269},"id":"ASB-A-503543341-72e7a02f"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/external/aac/+/731f21fc0465ed449f1ea4f2eeb1a2caa018d10f","target":{"function":"sbrDecoder_ResetElement","file":"cpp/libSBRdec/src/sbrdecoder.cpp"},"deprecated":false,"digest":{"function_hash":"84392081991445334554576529066623503018","length":3143},"id":"ASB-A-503543341-a8f12810","signature_type":"Function"},{"id":"ASB-A-503543341-fcb56aa4","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/aac/+/731f21fc0465ed449f1ea4f2eeb1a2caa018d10f","target":{"file":"cpp/libSBRdec/src/psdec.cpp"},"deprecated":false,"digest":{"line_hashes":["114523389872104252204719190986185224655","52734087664755297858522065030271643404","249180802433487277516859302557310721105","190370324579886490988075018855476556553","70497541627091865279224614301192197901","11594559990398991421972822504322731838","111026617037208209451039011650970094582","7079091851436901381992394123097794023","152938766106330417567262603253105698380","334050387712123716479090406104010799056","132114807583655856815247962521592626035","245111887418848632511805191558709262836","105215017151726902863961836764510084979"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/external/aac/+/731f21fc0465ed449f1ea4f2eeb1a2caa018d10f"],"severity":"Critical","spl":"2026-11-01","types":["RCE"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503543341.json"}},{"package":{"name":"platform/external/aac","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/aac/+/b90fa3b31838d804623aec8d1211023cc7565b59"],"severity":"Critical","spl":"2026-11-01","types":["RCE"],"vanir_signatures":[{"deprecated":false,"digest":{"length":3143,"function_hash":"84392081991445334554576529066623503018"},"id":"ASB-A-503543341-05f1a4ec","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/aac/+/b90fa3b31838d804623aec8d1211023cc7565b59","target":{"file":"libSBRdec/src/sbrdecoder.cpp","function":"sbrDecoder_ResetElement"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/aac/+/b90fa3b31838d804623aec8d1211023cc7565b59","target":{"file":"libSBRdec/src/sbrdecoder.cpp"},"deprecated":false,"digest":{"line_hashes":["153556380576910973068670790616142496210","135289179253646365718233578904619399164","92789277314867331282584572447910206592","210973425024332788952725228810583295016"],"threshold":0.9},"id":"ASB-A-503543341-8838016e"},{"target":{"function":"CreatePsDec","file":"libSBRdec/src/psdec.cpp"},"deprecated":false,"digest":{"function_hash":"141344615261513171099177882799310373828","length":1269},"id":"ASB-A-503543341-8e98e57d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/aac/+/b90fa3b31838d804623aec8d1211023cc7565b59"},{"digest":{"line_hashes":["114523389872104252204719190986185224655","52734087664755297858522065030271643404","249180802433487277516859302557310721105","190370324579886490988075018855476556553","70497541627091865279224614301192197901","11594559990398991421972822504322731838","111026617037208209451039011650970094582","7079091851436901381992394123097794023","152938766106330417567262603253105698380","334050387712123716479090406104010799056","132114807583655856815247962521592626035","245111887418848632511805191558709262836","105215017151726902863961836764510084979"],"threshold":0.9},"id":"ASB-A-503543341-a8c2751a","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/aac/+/b90fa3b31838d804623aec8d1211023cc7565b59","target":{"file":"libSBRdec/src/psdec.cpp"},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503543341.json"}},{"package":{"name":"platform/external/aac","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/aac/+/9e7bf9c16256ab837d36ef6ff0c0acbbf2c2a5a2"],"severity":"Critical","spl":"2026-11-01","types":["RCE"],"vanir_signatures":[{"digest":{"function_hash":"84392081991445334554576529066623503018","length":3143},"id":"ASB-A-503543341-30319392","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/aac/+/9e7bf9c16256ab837d36ef6ff0c0acbbf2c2a5a2","target":{"file":"libSBRdec/src/sbrdecoder.cpp","function":"sbrDecoder_ResetElement"},"deprecated":false},{"target":{"file":"libSBRdec/src/psdec.cpp"},"deprecated":false,"digest":{"line_hashes":["114523389872104252204719190986185224655","52734087664755297858522065030271643404","249180802433487277516859302557310721105","190370324579886490988075018855476556553","70497541627091865279224614301192197901","11594559990398991421972822504322731838","111026617037208209451039011650970094582","7079091851436901381992394123097794023","152938766106330417567262603253105698380","334050387712123716479090406104010799056","132114807583655856815247962521592626035","245111887418848632511805191558709262836","105215017151726902863961836764510084979"],"threshold":0.9},"id":"ASB-A-503543341-7ec9e072","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/aac/+/9e7bf9c16256ab837d36ef6ff0c0acbbf2c2a5a2"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/aac/+/9e7bf9c16256ab837d36ef6ff0c0acbbf2c2a5a2","target":{"function":"CreatePsDec","file":"libSBRdec/src/psdec.cpp"},"deprecated":false,"digest":{"function_hash":"141344615261513171099177882799310373828","length":1269},"id":"ASB-A-503543341-e688701c"},{"source":"https://android.googlesource.com/platform/external/aac/+/9e7bf9c16256ab837d36ef6ff0c0acbbf2c2a5a2","target":{"file":"libSBRdec/src/sbrdecoder.cpp"},"deprecated":false,"digest":{"line_hashes":["153556380576910973068670790616142496210","135289179253646365718233578904619399164","92789277314867331282584572447910206592","210973425024332788952725228810583295016"],"threshold":0.9},"id":"ASB-A-503543341-e8119a28","signature_type":"Line","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503543341.json"}},{"package":{"name":"platform/external/aac","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"types":["RCE"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/aac/+/998c1f994d482cfc4bd98596624b42eda06c18cb","target":{"function":"sbrDecoder_ResetElement","file":"libSBRdec/src/sbrdecoder.cpp"},"deprecated":false,"digest":{"length":3143,"function_hash":"84392081991445334554576529066623503018"},"id":"ASB-A-503543341-6dad6792"},{"digest":{"length":1269,"function_hash":"141344615261513171099177882799310373828"},"id":"ASB-A-503543341-a42782c4","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/aac/+/998c1f994d482cfc4bd98596624b42eda06c18cb","target":{"file":"libSBRdec/src/psdec.cpp","function":"CreatePsDec"},"deprecated":false},{"digest":{"line_hashes":["114523389872104252204719190986185224655","52734087664755297858522065030271643404","249180802433487277516859302557310721105","190370324579886490988075018855476556553","70497541627091865279224614301192197901","11594559990398991421972822504322731838","111026617037208209451039011650970094582","7079091851436901381992394123097794023","152938766106330417567262603253105698380","334050387712123716479090406104010799056","132114807583655856815247962521592626035","245111887418848632511805191558709262836","105215017151726902863961836764510084979"],"threshold":0.9},"id":"ASB-A-503543341-c51590f6","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/aac/+/998c1f994d482cfc4bd98596624b42eda06c18cb","target":{"file":"libSBRdec/src/psdec.cpp"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/external/aac/+/998c1f994d482cfc4bd98596624b42eda06c18cb","target":{"file":"libSBRdec/src/sbrdecoder.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["153556380576910973068670790616142496210","135289179253646365718233578904619399164","92789277314867331282584572447910206592","210973425024332788952725228810583295016"]},"id":"ASB-A-503543341-d3016617","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/external/aac/+/998c1f994d482cfc4bd98596624b42eda06c18cb"],"severity":"Critical","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503543341.json"}},{"package":{"name":"platform/external/aac","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/aac/+/91ff11fae88c6b2fc8be476ccdff31d13eb8b062"],"severity":"Critical","spl":"2026-11-01","types":["RCE"],"vanir_signatures":[{"target":{"file":"cpp/libSBRdec/src/psdec.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["114523389872104252204719190986185224655","52734087664755297858522065030271643404","249180802433487277516859302557310721105","190370324579886490988075018855476556553","70497541627091865279224614301192197901","11594559990398991421972822504322731838","111026617037208209451039011650970094582","7079091851436901381992394123097794023","152938766106330417567262603253105698380","334050387712123716479090406104010799056","132114807583655856815247962521592626035","245111887418848632511805191558709262836","105215017151726902863961836764510084979"]},"id":"ASB-A-503543341-21976d18","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/aac/+/91ff11fae88c6b2fc8be476ccdff31d13eb8b062"},{"target":{"function":"sbrDecoder_ResetElement","file":"cpp/libSBRdec/src/sbrdecoder.cpp"},"deprecated":false,"digest":{"function_hash":"84392081991445334554576529066623503018","length":3143},"id":"ASB-A-503543341-38951d21","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/aac/+/91ff11fae88c6b2fc8be476ccdff31d13eb8b062"},{"source":"https://android.googlesource.com/platform/external/aac/+/91ff11fae88c6b2fc8be476ccdff31d13eb8b062","target":{"file":"cpp/libSBRdec/src/psdec.cpp","function":"CreatePsDec"},"deprecated":false,"digest":{"function_hash":"141344615261513171099177882799310373828","length":1269},"id":"ASB-A-503543341-cd8e6d9a","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["153556380576910973068670790616142496210","135289179253646365718233578904619399164","92789277314867331282584572447910206592","210973425024332788952725228810583295016"],"threshold":0.9},"id":"ASB-A-503543341-ea06f06c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/aac/+/91ff11fae88c6b2fc8be476ccdff31d13eb8b062","target":{"file":"cpp/libSBRdec/src/sbrdecoder.cpp"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503543341.json"}},{"package":{"name":"platform/external/aac","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["153556380576910973068670790616142496210","135289179253646365718233578904619399164","92789277314867331282584572447910206592","210973425024332788952725228810583295016"],"threshold":0.9},"id":"ASB-A-503543341-345bff5f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/aac/+/49a60367032ca85866dd5650bf074b5f5c1ec83d","target":{"file":"libSBRdec/src/sbrdecoder.cpp"}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/aac/+/49a60367032ca85866dd5650bf074b5f5c1ec83d","target":{"file":"libSBRdec/src/sbrdecoder.cpp","function":"sbrDecoder_ResetElement"},"deprecated":false,"digest":{"length":3143,"function_hash":"84392081991445334554576529066623503018"},"id":"ASB-A-503543341-46f05ec3"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/external/aac/+/49a60367032ca85866dd5650bf074b5f5c1ec83d","target":{"function":"CreatePsDec","file":"libSBRdec/src/psdec.cpp"},"deprecated":false,"digest":{"function_hash":"141344615261513171099177882799310373828","length":1269},"id":"ASB-A-503543341-b4c28f3d","signature_type":"Function"},{"digest":{"threshold":0.9,"line_hashes":["114523389872104252204719190986185224655","52734087664755297858522065030271643404","249180802433487277516859302557310721105","190370324579886490988075018855476556553","70497541627091865279224614301192197901","11594559990398991421972822504322731838","111026617037208209451039011650970094582","7079091851436901381992394123097794023","152938766106330417567262603253105698380","334050387712123716479090406104010799056","132114807583655856815247962521592626035","245111887418848632511805191558709262836","105215017151726902863961836764510084979"]},"id":"ASB-A-503543341-e5cc455f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/aac/+/49a60367032ca85866dd5650bf074b5f5c1ec83d","target":{"file":"libSBRdec/src/psdec.cpp"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/external/aac/+/49a60367032ca85866dd5650bf074b5f5c1ec83d"],"severity":"Critical","spl":"2026-11-01","types":["RCE"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503543341.json"}}],"schema_version":"1.9.2"}