{"id":"ASB-A-505573349","details":"In multiple locations, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-505573349","CVE-2026-59014"],"modified":"2026-11-02T16:56:27.735997795Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["191467825398377786251666639486469748630","150161165375455460557235390673890044180","2958726379898534217752220209089362718","123793736632110521421213141326966255447"],"threshold":0.9},"id":"ASB-A-505573349-0cba14f9","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/eba106323c26c613eb691cc596dbc1f08dcd68ac","target":{"file":"services/surfaceflinger/CompositionEngine/src/OutputLayer.cpp"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/eba106323c26c613eb691cc596dbc1f08dcd68ac","target":{"file":"libs/gui/include/gui/DisplayLuts.h"},"deprecated":false,"digest":{"line_hashes":["12182087954723442390270060520787039407","335360298579743726595931731980350609620","91288810878988681058462168503858339419","213621721779173727540727713583887891406","122315550365338448743216626366553583326","66650679333701507777444546691032784349","1462556243425985515940845828390712391","64747050226822153175332398885388512885","89669649789767390010890410874821692133","167139909948053108290762224495945084822","22947315436081328134728398530658348679","144477537473474114116926267259406357855"],"threshold":0.9},"id":"ASB-A-505573349-2383ddca"},{"source":"https://android.googlesource.com/platform/frameworks/native/+/eba106323c26c613eb691cc596dbc1f08dcd68ac","target":{"function":"OutputLayer::writeLutToHWC","file":"services/surfaceflinger/CompositionEngine/src/OutputLayer.cpp"},"deprecated":false,"digest":{"function_hash":"261644103858373577424874844659469709521","length":1102},"id":"ASB-A-505573349-32f4271b","signature_type":"Function","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/frameworks/native/+/eba106323c26c613eb691cc596dbc1f08dcd68ac","target":{"file":"libs/gui/DisplayLuts.cpp","function":"DisplayLuts::dump"},"deprecated":false,"digest":{"function_hash":"326272560078591086855877025915979604646","length":1373},"id":"ASB-A-505573349-622e9950","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/eba106323c26c613eb691cc596dbc1f08dcd68ac","target":{"file":"libs/gui/DisplayLuts.cpp","function":"DisplayLuts::readFromParcel"},"deprecated":false,"digest":{"function_hash":"230917011081759175075514511759086582967","length":510},"id":"ASB-A-505573349-8de65b1d","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["233785455079714541795473995159900928012","10839256194505176810976997969034464165","252251384673893540544078243937761770331","78507252115372392551262803394173740732","117446423390534008438487851886122604996","26310424987140171687193551136126251105","300868559578594934823983977888583922739","87850267325964541063081394572919209741","166773197868307257790019241920763222267","137398449032948708736241749953978601607","269030989649599630585721479334328439852","327423022203981586938680532831693700990","6484493589222773097395802489545268283","275375657933677188965272891362546394641","228033050919245051865841791309212037575","270390184930056128990218000164684190013","59778452048945977552017131784553623450","205127819580200694941441775505474352870","278346286606242307797264130331400717438","156038476278794882459639093295885188578","195941778326606299746196851479791818794","143103199039479189416069456386452813835","74776072425755072466099515353129117087","178275951987396959051597636609028770612","133098973365069811846557287128632378124","208863810585033004336721435274777186127","77479419700846798260683056873712928327","319175716102733403492180188274629489237","98528543215901569886215178075331001646","129163635834844056241535400114270241156","131568117739354716093116073061401393345","230795895281123392278590192986502155368","42044924789489412408178496240854432089","123995636807044638721390081619501833768","292938202421065300527485311459889901113","197391546236889604500064552151597544747","151278564384159623095388162331912350132","70950756174980933136007032323131541495","242644355184722462384211348426472995854","146719885372395999483087910166676174891","329615202909537672117388914286807456208","18660463739622949669372817337511374612"],"threshold":0.9},"id":"ASB-A-505573349-d1c11803","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/eba106323c26c613eb691cc596dbc1f08dcd68ac","target":{"file":"libs/renderengine/skia/filters/LutShader.cpp"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/eba106323c26c613eb691cc596dbc1f08dcd68ac","target":{"file":"libs/gui/DisplayLuts.cpp"},"deprecated":false,"digest":{"line_hashes":["188221411942361106045283809842547795313","274324584942458936757664496867126575066","300610598805878019712217563883632339663","169729078505312020648087133667116989295","231744238840827860779952402368297625260","118046073615630130744271058778586608749","332310619470369088614937062791827483556","157769289111788844106801046720132052465","17724723226935042087381341623217711079","105445573230663925606562607603324143510","300038686375673737522545789976241285840","181909983354185979789298602247146622890","216984304736227775516421880508554761762","278252454792669256660708957529546292018","138505583533038015480266409185015305208","3767107491689649968425482557467638863","177415106075934343673872005116025391070","195911443334300304378370539362506113882","187079036630418559897136007338122594105","185015310907484765006578676948033147452","310445083496161246849584039506624922963","25527379577771890240699153056465227181","115108053463345967228853943171681507477","285222984964760643938407738565334697295","67170259429351787764079601047205171503","171788219796236923204227075702195767204","330499745971359182651138694707828753853","202967784100637112805256016431297209613","265018868217079514370788365480253223588","330022590289310555697062118940361381036","232011179269272826075897402848053860981"],"threshold":0.9},"id":"ASB-A-505573349-ee44f48c","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/frameworks/native/+/eba106323c26c613eb691cc596dbc1f08dcd68ac"],"severity":"High","spl":"2026-11-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-505573349.json"}},{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/native/+/df43ebed94e68b02d6470df79d4fa8128ced0d5c"],"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"216594581376561541936725621643331232436","length":952},"id":"ASB-A-505573349-34eccf0c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/df43ebed94e68b02d6470df79d4fa8128ced0d5c","target":{"file":"services/surfaceflinger/CompositionEngine/src/OutputLayer.cpp","function":"OutputLayer::writeLutToHWC"}},{"deprecated":false,"digest":{"line_hashes":["211101567794090220879880283184459299865","40661517102625043927492069692292659044","340131400375725187491830323882730433385","120761647682265464748589161976897496126","67170259429351787764079601047205171503","171788219796236923204227075702195767204","330499745971359182651138694707828753853","202967784100637112805256016431297209613","265018868217079514370788365480253223588","330022590289310555697062118940361381036","232011179269272826075897402848053860981"],"threshold":0.9},"id":"ASB-A-505573349-44b954a6","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/df43ebed94e68b02d6470df79d4fa8128ced0d5c","target":{"file":"libs/gui/DisplayLuts.cpp"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/df43ebed94e68b02d6470df79d4fa8128ced0d5c","target":{"file":"libs/gui/include/gui/DisplayLuts.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["12182087954723442390270060520787039407","335360298579743726595931731980350609620","91288810878988681058462168503858339419","213621721779173727540727713583887891406","122315550365338448743216626366553583326","66650679333701507777444546691032784349","1462556243425985515940845828390712391","64747050226822153175332398885388512885","270672486199677915304030395123563031441","229892861462817950172827740191356826317","145261338608955912896421127967992500269"]},"id":"ASB-A-505573349-751158da","signature_type":"Line"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/df43ebed94e68b02d6470df79d4fa8128ced0d5c","target":{"file":"libs/renderengine/skia/filters/LutShader.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["81307560553407864522916339845828073910","299234165252532708801777753639215511629","125746530476434884166032122406323430228","60237093484120934184829571340311294334","38105691660628998389648725619266183401","264447289843536843663114130844960449197","188204158514693941057725563303430703341","41196654969941182007043469220767184984","266760650413157783261207162421310325847","32249896564743102503565228471285839154","281746065773557026305447163369541588353","3552144485307119762075865549718979955","105305535355611184897838705003108132639","223075103657865001290747655541669806653","155878507827982382522710647715441351083","204724447018666350812283236662817345855","87511565852422466172814233085268489141","327423022203981586938680532831693700990","6484493589222773097395802489545268283","275375657933677188965272891362546394641","228033050919245051865841791309212037575","270390184930056128990218000164684190013","59778452048945977552017131784553623450","205127819580200694941441775505474352870","278346286606242307797264130331400717438","156038476278794882459639093295885188578","195941778326606299746196851479791818794","143103199039479189416069456386452813835","74776072425755072466099515353129117087","178275951987396959051597636609028770612","133098973365069811846557287128632378124","208863810585033004336721435274777186127","77479419700846798260683056873712928327","319175716102733403492180188274629489237","98528543215901569886215178075331001646","129163635834844056241535400114270241156","131568117739354716093116073061401393345","230795895281123392278590192986502155368","42044924789489412408178496240854432089","123995636807044638721390081619501833768","172979803726583747484497449008717735461","155423290442698650466986820687635644346","2705495356949085438345705966978600882","81618750468869052862977753386001773854","16991665595551430309595209036857862411","1064634784707602530915870999425539255","51542946378391922541940627762325735158","199676639345170706328501174162307895203","84752518255902757075571582553955990274"]},"id":"ASB-A-505573349-7a140826","signature_type":"Line"},{"source":"https://android.googlesource.com/platform/frameworks/native/+/df43ebed94e68b02d6470df79d4fa8128ced0d5c","target":{"file":"services/surfaceflinger/CompositionEngine/src/OutputLayer.cpp"},"deprecated":false,"digest":{"line_hashes":["244921919601930954922815840625046799275","250431618234703748075491640011371816662","200251861028762718630075760933052291291","39707455275815951768649825911646532418"],"threshold":0.9},"id":"ASB-A-505573349-f7fc516f","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/df43ebed94e68b02d6470df79d4fa8128ced0d5c","target":{"function":"DisplayLuts::readFromParcel","file":"libs/gui/DisplayLuts.cpp"},"deprecated":false,"digest":{"function_hash":"230917011081759175075514511759086582967","length":510},"id":"ASB-A-505573349-ff03a865"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-505573349.json"}},{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/native/+/da3dd9b803688a620459457ca87c769316598601"],"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"digest":{"line_hashes":["12182087954723442390270060520787039407","335360298579743726595931731980350609620","91288810878988681058462168503858339419","213621721779173727540727713583887891406","122315550365338448743216626366553583326","66650679333701507777444546691032784349","1462556243425985515940845828390712391","64747050226822153175332398885388512885","270672486199677915304030395123563031441","229892861462817950172827740191356826317","145261338608955912896421127967992500269"],"threshold":0.9},"id":"ASB-A-505573349-27b2e2c7","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/da3dd9b803688a620459457ca87c769316598601","target":{"file":"libs/gui/include/gui/DisplayLuts.h"},"deprecated":false},{"id":"ASB-A-505573349-27b53ba0","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/da3dd9b803688a620459457ca87c769316598601","target":{"function":"OutputLayer::writeLutToHWC","file":"services/surfaceflinger/CompositionEngine/src/OutputLayer.cpp"},"deprecated":false,"digest":{"function_hash":"216594581376561541936725621643331232436","length":952}},{"source":"https://android.googlesource.com/platform/frameworks/native/+/da3dd9b803688a620459457ca87c769316598601","target":{"function":"DisplayLuts::readFromParcel","file":"libs/gui/DisplayLuts.cpp"},"deprecated":false,"digest":{"function_hash":"230917011081759175075514511759086582967","length":510},"id":"ASB-A-505573349-34523beb","signature_type":"Function","signature_version":"v1"},{"target":{"file":"libs/renderengine/skia/filters/LutShader.cpp"},"deprecated":false,"digest":{"line_hashes":["233785455079714541795473995159900928012","10839256194505176810976997969034464165","252251384673893540544078243937761770331","78507252115372392551262803394173740732","330405344359162732710726687178813100243","137310120305420143778845232524095758060","300868559578594934823983977888583922739","87850267325964541063081394572919209741","166773197868307257790019241920763222267","137398449032948708736241749953978601607","269030989649599630585721479334328439852","327423022203981586938680532831693700990","6484493589222773097395802489545268283","275375657933677188965272891362546394641","228033050919245051865841791309212037575","270390184930056128990218000164684190013","59778452048945977552017131784553623450","205127819580200694941441775505474352870","278346286606242307797264130331400717438","156038476278794882459639093295885188578","195941778326606299746196851479791818794","143103199039479189416069456386452813835","74776072425755072466099515353129117087","178275951987396959051597636609028770612","133098973365069811846557287128632378124","208863810585033004336721435274777186127","77479419700846798260683056873712928327","319175716102733403492180188274629489237","98528543215901569886215178075331001646","129163635834844056241535400114270241156","131568117739354716093116073061401393345","230795895281123392278590192986502155368","42044924789489412408178496240854432089","123995636807044638721390081619501833768","172979803726583747484497449008717735461","155423290442698650466986820687635644346","2705495356949085438345705966978600882","81618750468869052862977753386001773854","229827009762973993012444725773104252443","127949087307600841405099231486669595831","18660463739622949669372817337511374612"],"threshold":0.9},"id":"ASB-A-505573349-3aafa58b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/da3dd9b803688a620459457ca87c769316598601"},{"source":"https://android.googlesource.com/platform/frameworks/native/+/da3dd9b803688a620459457ca87c769316598601","target":{"file":"services/surfaceflinger/CompositionEngine/src/OutputLayer.cpp"},"deprecated":false,"digest":{"line_hashes":["244921919601930954922815840625046799275","250431618234703748075491640011371816662","200251861028762718630075760933052291291","39707455275815951768649825911646532418"],"threshold":0.9},"id":"ASB-A-505573349-4b57b13e","signature_type":"Line","signature_version":"v1"},{"id":"ASB-A-505573349-d741ab62","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/da3dd9b803688a620459457ca87c769316598601","target":{"file":"libs/gui/DisplayLuts.cpp"},"deprecated":false,"digest":{"line_hashes":["211101567794090220879880283184459299865","40661517102625043927492069692292659044","340131400375725187491830323882730433385","120761647682265464748589161976897496126","67170259429351787764079601047205171503","171788219796236923204227075702195767204","330499745971359182651138694707828753853","202967784100637112805256016431297209613","265018868217079514370788365480253223588","330022590289310555697062118940361381036","232011179269272826075897402848053860981"],"threshold":0.9}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-505573349.json"}},{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/native/+/81ca3984d5dfa51246e99702eed2ee826d5701e5"],"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["191467825398377786251666639486469748630","150161165375455460557235390673890044180","2958726379898534217752220209089362718","123793736632110521421213141326966255447"],"threshold":0.9},"id":"ASB-A-505573349-4a36b263","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/81ca3984d5dfa51246e99702eed2ee826d5701e5","target":{"file":"services/surfaceflinger/CompositionEngine/src/OutputLayer.cpp"}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["233785455079714541795473995159900928012","10839256194505176810976997969034464165","252251384673893540544078243937761770331","78507252115372392551262803394173740732","27172958099552850718143297867887390777","260599572451795247197277031369856326764","300868559578594934823983977888583922739","87850267325964541063081394572919209741","166773197868307257790019241920763222267","137398449032948708736241749953978601607","269030989649599630585721479334328439852","327423022203981586938680532831693700990","6484493589222773097395802489545268283","275375657933677188965272891362546394641","228033050919245051865841791309212037575","270390184930056128990218000164684190013","59778452048945977552017131784553623450","205127819580200694941441775505474352870","278346286606242307797264130331400717438","156038476278794882459639093295885188578","195941778326606299746196851479791818794","143103199039479189416069456386452813835","74776072425755072466099515353129117087","178275951987396959051597636609028770612","133098973365069811846557287128632378124","208863810585033004336721435274777186127","77479419700846798260683056873712928327","319175716102733403492180188274629489237","98528543215901569886215178075331001646","129163635834844056241535400114270241156","131568117739354716093116073061401393345","230795895281123392278590192986502155368","42044924789489412408178496240854432089","123995636807044638721390081619501833768","172979803726583747484497449008717735461","155423290442698650466986820687635644346","2705495356949085438345705966978600882","81618750468869052862977753386001773854","229827009762973993012444725773104252443","127949087307600841405099231486669595831","18660463739622949669372817337511374612"]},"id":"ASB-A-505573349-5f30e14d","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/81ca3984d5dfa51246e99702eed2ee826d5701e5","target":{"file":"libs/renderengine/skia/filters/LutShader.cpp"}},{"target":{"file":"libs/gui/DisplayLuts.cpp","function":"DisplayLuts::dump"},"deprecated":false,"digest":{"function_hash":"326272560078591086855877025915979604646","length":1373},"id":"ASB-A-505573349-71e89f71","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/81ca3984d5dfa51246e99702eed2ee826d5701e5"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/81ca3984d5dfa51246e99702eed2ee826d5701e5","target":{"function":"DisplayLuts::readFromParcel","file":"libs/gui/DisplayLuts.cpp"},"deprecated":false,"digest":{"length":510,"function_hash":"230917011081759175075514511759086582967"},"id":"ASB-A-505573349-953f48ba"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/81ca3984d5dfa51246e99702eed2ee826d5701e5","target":{"file":"libs/gui/DisplayLuts.cpp"},"deprecated":false,"digest":{"line_hashes":["188221411942361106045283809842547795313","274324584942458936757664496867126575066","300610598805878019712217563883632339663","169729078505312020648087133667116989295","231744238840827860779952402368297625260","118046073615630130744271058778586608749","332310619470369088614937062791827483556","157769289111788844106801046720132052465","17724723226935042087381341623217711079","105445573230663925606562607603324143510","300038686375673737522545789976241285840","181909983354185979789298602247146622890","216984304736227775516421880508554761762","278252454792669256660708957529546292018","138505583533038015480266409185015305208","3767107491689649968425482557467638863","177415106075934343673872005116025391070","195911443334300304378370539362506113882","187079036630418559897136007338122594105","185015310907484765006578676948033147452","310445083496161246849584039506624922963","25527379577771890240699153056465227181","115108053463345967228853943171681507477","285222984964760643938407738565334697295","67170259429351787764079601047205171503","171788219796236923204227075702195767204","330499745971359182651138694707828753853","202967784100637112805256016431297209613","265018868217079514370788365480253223588","330022590289310555697062118940361381036","232011179269272826075897402848053860981"],"threshold":0.9},"id":"ASB-A-505573349-c71a0d3f"},{"source":"https://android.googlesource.com/platform/frameworks/native/+/81ca3984d5dfa51246e99702eed2ee826d5701e5","target":{"file":"services/surfaceflinger/CompositionEngine/src/OutputLayer.cpp","function":"OutputLayer::writeLutToHWC"},"deprecated":false,"digest":{"length":1102,"function_hash":"261644103858373577424874844659469709521"},"id":"ASB-A-505573349-ca3a907c","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/81ca3984d5dfa51246e99702eed2ee826d5701e5","target":{"file":"libs/gui/include/gui/DisplayLuts.h"},"deprecated":false,"digest":{"line_hashes":["12182087954723442390270060520787039407","335360298579743726595931731980350609620","91288810878988681058462168503858339419","213621721779173727540727713583887891406","122315550365338448743216626366553583326","66650679333701507777444546691032784349","1462556243425985515940845828390712391","64747050226822153175332398885388512885","89669649789767390010890410874821692133","167139909948053108290762224495945084822","22947315436081328134728398530658348679","144477537473474114116926267259406357855"],"threshold":0.9},"id":"ASB-A-505573349-dd18aa74","signature_type":"Line"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-505573349.json"}}],"schema_version":"1.9.2"}