{"id":"ASB-A-503550257","details":"In convertCleanApertureToRect of HeifCleanAperture.cpp, there is a possible way to cause a temporary denial of service due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-503550257","CVE-2026-45527"],"modified":"2026-09-09T15:15:54.249544283Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["DoS"],"vanir_signatures":[{"digest":{"function_hash":"210171921972152551315120600398832412273","length":1178},"id":"ASB-A-503550257-8d428cca","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/5fcd67a562a2dffdfaf25f35c7acf805a96ac8ae","target":{"file":"media/module/extractors/mp4/HeifCleanAperture.cpp","function":"convertCleanApertureToRect"},"deprecated":false},{"id":"ASB-A-503550257-ed49c964","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/5fcd67a562a2dffdfaf25f35c7acf805a96ac8ae","target":{"file":"media/module/extractors/mp4/HeifCleanAperture.cpp"},"deprecated":false,"digest":{"line_hashes":["318736455688245529106157687268192692578","196019943657244917141137895965964911018","267706078232852432098468081885247771869","282099285052783854959186613359706831944","339627395350488442128001998112282428198","155817594825882580775796430986338350416","249145424279417647104309460021634999527","105135349804760838859480469610730392589","102715412356406950219770955940244365114"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/5fcd67a562a2dffdfaf25f35c7acf805a96ac8ae"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503550257.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["DoS"],"vanir_signatures":[{"id":"ASB-A-503550257-399bbc6f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/0b5385b693c06f6976aaa1955b704e6afc5f3fc7","target":{"file":"media/module/extractors/mp4/HeifCleanAperture.cpp"},"deprecated":false,"digest":{"line_hashes":["318736455688245529106157687268192692578","196019943657244917141137895965964911018","267706078232852432098468081885247771869","282099285052783854959186613359706831944","339627395350488442128001998112282428198","155817594825882580775796430986338350416","249145424279417647104309460021634999527","105135349804760838859480469610730392589","102715412356406950219770955940244365114"],"threshold":0.9}},{"digest":{"length":1178,"function_hash":"210171921972152551315120600398832412273"},"id":"ASB-A-503550257-8c128ed3","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/0b5385b693c06f6976aaa1955b704e6afc5f3fc7","target":{"function":"convertCleanApertureToRect","file":"media/module/extractors/mp4/HeifCleanAperture.cpp"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/0b5385b693c06f6976aaa1955b704e6afc5f3fc7"],"severity":"High","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503550257.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"types":["DoS"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/4ee19decff042654c08cd62ece8cc8e0de15d06f","target":{"file":"media/module/extractors/mp4/HeifCleanAperture.cpp"},"deprecated":false,"digest":{"line_hashes":["318736455688245529106157687268192692578","196019943657244917141137895965964911018","267706078232852432098468081885247771869","282099285052783854959186613359706831944","339627395350488442128001998112282428198","155817594825882580775796430986338350416","249145424279417647104309460021634999527","105135349804760838859480469610730392589","102715412356406950219770955940244365114"],"threshold":0.9},"id":"ASB-A-503550257-86548ffa"},{"id":"ASB-A-503550257-d72c3bf4","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/4ee19decff042654c08cd62ece8cc8e0de15d06f","target":{"file":"media/module/extractors/mp4/HeifCleanAperture.cpp","function":"convertCleanApertureToRect"},"deprecated":false,"digest":{"function_hash":"210171921972152551315120600398832412273","length":1178}}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/4ee19decff042654c08cd62ece8cc8e0de15d06f"],"severity":"High","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503550257.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["DoS"],"vanir_signatures":[{"target":{"file":"media/module/extractors/mp4/HeifCleanAperture.cpp","function":"convertCleanApertureToRect"},"deprecated":false,"digest":{"function_hash":"210171921972152551315120600398832412273","length":1178},"id":"ASB-A-503550257-4a45c07d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/0c4039a07cc1ac03c4450dc6ca121a41cd7cbfd2"},{"source":"https://android.googlesource.com/platform/frameworks/av/+/0c4039a07cc1ac03c4450dc6ca121a41cd7cbfd2","target":{"file":"media/module/extractors/mp4/HeifCleanAperture.cpp"},"deprecated":false,"digest":{"line_hashes":["318736455688245529106157687268192692578","196019943657244917141137895965964911018","267706078232852432098468081885247771869","282099285052783854959186613359706831944","339627395350488442128001998112282428198","155817594825882580775796430986338350416","249145424279417647104309460021634999527","105135349804760838859480469610730392589","102715412356406950219770955940244365114"],"threshold":0.9},"id":"ASB-A-503550257-b920a1e9","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/0c4039a07cc1ac03c4450dc6ca121a41cd7cbfd2"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503550257.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"spl":"2026-09-01","types":["DoS"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/av/+/91c2a108e4ef9dda4e27c4b83b7fafc76b09cd55","target":{"file":"media/module/extractors/mp4/HeifCleanAperture.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["318736455688245529106157687268192692578","196019943657244917141137895965964911018","267706078232852432098468081885247771869","282099285052783854959186613359706831944","339627395350488442128001998112282428198","155817594825882580775796430986338350416","249145424279417647104309460021634999527","105135349804760838859480469610730392589","102715412356406950219770955940244365114"]},"id":"ASB-A-503550257-2e72f141","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/91c2a108e4ef9dda4e27c4b83b7fafc76b09cd55","target":{"file":"media/module/extractors/mp4/HeifCleanAperture.cpp","function":"convertCleanApertureToRect"},"deprecated":false,"digest":{"function_hash":"210171921972152551315120600398832412273","length":1178},"id":"ASB-A-503550257-b444c574","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/91c2a108e4ef9dda4e27c4b83b7fafc76b09cd55"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503550257.json"}}],"schema_version":"1.9.0"}