{"id":"ASB-A-503556301","details":"In tt_face_colr_blend_layer of ttcolr.c, there is a possible remote code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-503556301","CVE-2026-49919"],"modified":"2026-09-11T15:42:03.104094163Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/external/freetype","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"types":["RCE"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/external/freetype/+/1ed98bcb2c12fe4b091f76331eb87e4bfd06a2a3","target":{"file":"src/sfnt/ttcolr.c","function":"tt_face_colr_blend_layer"},"deprecated":false,"digest":{"function_hash":"97235557066984497634424696470174124816","length":3777},"id":"ASB-A-503556301-5acb904a","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["50627479505215735284437109917706726073","105462463043027474413150166373265447612","152620721674789381141437778907148675356","52423357747878251098044166972117762165","176492909967995815732788262970484458588"]},"id":"ASB-A-503556301-7c148d7c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/freetype/+/1ed98bcb2c12fe4b091f76331eb87e4bfd06a2a3","target":{"file":"src/sfnt/ttcolr.c"}}],"fixes":["https://android.googlesource.com/platform/external/freetype/+/1ed98bcb2c12fe4b091f76331eb87e4bfd06a2a3"],"severity":"Critical","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503556301.json"}},{"package":{"name":"platform/external/freetype","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["RCE"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["50627479505215735284437109917706726073","105462463043027474413150166373265447612","152620721674789381141437778907148675356","52423357747878251098044166972117762165","176492909967995815732788262970484458588"],"threshold":0.9},"id":"ASB-A-503556301-ba4703d1","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/freetype/+/cbb53be32c64802d765e908ae1d7e76eb5e6ead2","target":{"file":"src/sfnt/ttcolr.c"}},{"deprecated":false,"digest":{"function_hash":"97235557066984497634424696470174124816","length":3777},"id":"ASB-A-503556301-cfe45055","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/freetype/+/cbb53be32c64802d765e908ae1d7e76eb5e6ead2","target":{"file":"src/sfnt/ttcolr.c","function":"tt_face_colr_blend_layer"}}],"fixes":["https://android.googlesource.com/platform/external/freetype/+/cbb53be32c64802d765e908ae1d7e76eb5e6ead2"],"severity":"Critical","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503556301.json"}},{"package":{"name":"platform/external/freetype","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/freetype/+/89994f1badeeef775693144353d7af43930470c2","target":{"file":"src/sfnt/ttcolr.c"},"deprecated":false,"digest":{"line_hashes":["50627479505215735284437109917706726073","105462463043027474413150166373265447612","152620721674789381141437778907148675356","52423357747878251098044166972117762165","176492909967995815732788262970484458588"],"threshold":0.9},"id":"ASB-A-503556301-4ef8fefc"},{"source":"https://android.googlesource.com/platform/external/freetype/+/89994f1badeeef775693144353d7af43930470c2","target":{"file":"src/sfnt/ttcolr.c","function":"tt_face_colr_blend_layer"},"deprecated":false,"digest":{"function_hash":"97235557066984497634424696470174124816","length":3777},"id":"ASB-A-503556301-506aa5cd","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/external/freetype/+/89994f1badeeef775693144353d7af43930470c2"],"severity":"Critical","spl":"2026-09-01","types":["RCE"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503556301.json"}},{"package":{"name":"platform/external/freetype","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"vanir_signatures":[{"source":"https://android.googlesource.com/platform/external/freetype/+/beebd7aab7f3bca9c794d4eac5d2ddd739850779","target":{"file":"src/sfnt/ttcolr.c"},"deprecated":false,"digest":{"line_hashes":["50627479505215735284437109917706726073","105462463043027474413150166373265447612","152620721674789381141437778907148675356","52423357747878251098044166972117762165","176492909967995815732788262970484458588"],"threshold":0.9},"id":"ASB-A-503556301-8fdee71c","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"97235557066984497634424696470174124816","length":3777},"id":"ASB-A-503556301-a1b4b731","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/freetype/+/beebd7aab7f3bca9c794d4eac5d2ddd739850779","target":{"file":"src/sfnt/ttcolr.c","function":"tt_face_colr_blend_layer"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/external/freetype/+/beebd7aab7f3bca9c794d4eac5d2ddd739850779"],"severity":"Critical","spl":"2026-09-01","types":["RCE"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503556301.json"}},{"package":{"name":"platform/external/freetype","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/freetype/+/a03d4b6378c6187ed068a4e50c80764653d8350b"],"severity":"Critical","spl":"2026-09-01","types":["RCE"],"vanir_signatures":[{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["50627479505215735284437109917706726073","105462463043027474413150166373265447612","152620721674789381141437778907148675356","52423357747878251098044166972117762165","176492909967995815732788262970484458588"]},"id":"ASB-A-503556301-185b706a","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/freetype/+/a03d4b6378c6187ed068a4e50c80764653d8350b","target":{"file":"src/sfnt/ttcolr.c"}},{"digest":{"function_hash":"97235557066984497634424696470174124816","length":3777},"id":"ASB-A-503556301-cca1ad1e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/freetype/+/a03d4b6378c6187ed068a4e50c80764653d8350b","target":{"file":"src/sfnt/ttcolr.c","function":"tt_face_colr_blend_layer"},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503556301.json"}},{"package":{"name":"platform/external/freetype","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-09-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"Critical","spl":"2026-09-01","types":["RCE"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/freetype/+/adad74a00ff51f6ceb60e78dfe1ccd12fbcd5ba7","target":{"file":"src/sfnt/ttcolr.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["50627479505215735284437109917706726073","105462463043027474413150166373265447612","152620721674789381141437778907148675356","52423357747878251098044166972117762165","176492909967995815732788262970484458588"]},"id":"ASB-A-503556301-50a05cc5"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/freetype/+/adad74a00ff51f6ceb60e78dfe1ccd12fbcd5ba7","target":{"file":"src/sfnt/ttcolr.c","function":"tt_face_colr_blend_layer"},"deprecated":false,"digest":{"function_hash":"97235557066984497634424696470174124816","length":3777},"id":"ASB-A-503556301-eeeddbb6"}],"fixes":["https://android.googlesource.com/platform/external/freetype/+/adad74a00ff51f6ceb60e78dfe1ccd12fbcd5ba7"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503556301.json"}}],"schema_version":"1.9.0"}