{"id":"ASB-A-505748392","details":"In getEntryFileName of ZipFileRO.cpp, there is a possible memory safety issue due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-505748392","CVE-2026-58995"],"modified":"2026-11-02T17:11:16.134472945Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"vanir_signatures":[{"id":"ASB-A-505748392-3856055c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6da5fc97ce52a80efbc46af3cb3330152b6d7e1b","target":{"function":"ZipFileRO::getEntryFileName","file":"libs/androidfw/ZipFileRO.cpp"},"deprecated":false,"digest":{"length":405,"function_hash":"194482363648532907574043945036591750697"}},{"digest":{"threshold":0.9,"line_hashes":["217393691783784062743186263382289736587","251243380099684899172006670758014669102","160757615909430888168392578688260034243"]},"id":"ASB-A-505748392-5f04d57c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6da5fc97ce52a80efbc46af3cb3330152b6d7e1b","target":{"file":"libs/androidfw/include/androidfw/ZipFileRO.h"},"deprecated":false},{"id":"ASB-A-505748392-7e384ba3","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6da5fc97ce52a80efbc46af3cb3330152b6d7e1b","target":{"file":"libs/androidfw/ZipFileRO.cpp"},"deprecated":false,"digest":{"line_hashes":["255273107764280999950999932921386056299","200770063162390918579106892912898843566","127628624804953613033083286504704442189","10770843555836785776292486916865778428","148386236082038627021727118362863878045","229865868111145925047752915818625423152"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/6da5fc97ce52a80efbc46af3cb3330152b6d7e1b"],"severity":"High","spl":"2026-11-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-505748392.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"vanir_signatures":[{"digest":{"function_hash":"194482363648532907574043945036591750697","length":405},"id":"ASB-A-505748392-2645f6ef","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c003ce6c6c4ee148722bdb6ba9407a4c349e61a5","target":{"function":"ZipFileRO::getEntryFileName","file":"libs/androidfw/ZipFileRO.cpp"},"deprecated":false},{"target":{"file":"libs/androidfw/ZipFileRO.cpp"},"deprecated":false,"digest":{"line_hashes":["255273107764280999950999932921386056299","200770063162390918579106892912898843566","127628624804953613033083286504704442189","10770843555836785776292486916865778428","148386236082038627021727118362863878045","229865868111145925047752915818625423152"],"threshold":0.9},"id":"ASB-A-505748392-e6314177","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c003ce6c6c4ee148722bdb6ba9407a4c349e61a5"},{"id":"ASB-A-505748392-f7f9990a","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c003ce6c6c4ee148722bdb6ba9407a4c349e61a5","target":{"file":"libs/androidfw/include/androidfw/ZipFileRO.h"},"deprecated":false,"digest":{"line_hashes":["217393691783784062743186263382289736587","251243380099684899172006670758014669102","160757615909430888168392578688260034243"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/c003ce6c6c4ee148722bdb6ba9407a4c349e61a5"],"severity":"High","spl":"2026-11-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-505748392.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/61053a062cdffc5c24ebd770c40ee4d8996d1f40"],"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"length":405,"function_hash":"194482363648532907574043945036591750697"},"id":"ASB-A-505748392-55acb9bf","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/61053a062cdffc5c24ebd770c40ee4d8996d1f40","target":{"function":"ZipFileRO::getEntryFileName","file":"libs/androidfw/ZipFileRO.cpp"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/61053a062cdffc5c24ebd770c40ee4d8996d1f40","target":{"file":"libs/androidfw/include/androidfw/ZipFileRO.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["217393691783784062743186263382289736587","251243380099684899172006670758014669102","160757615909430888168392578688260034243"]},"id":"ASB-A-505748392-bf74907d"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/61053a062cdffc5c24ebd770c40ee4d8996d1f40","target":{"file":"libs/androidfw/ZipFileRO.cpp"},"deprecated":false,"digest":{"line_hashes":["255273107764280999950999932921386056299","200770063162390918579106892912898843566","127628624804953613033083286504704442189","10770843555836785776292486916865778428","148386236082038627021727118362863878045","229865868111145925047752915818625423152"],"threshold":0.9},"id":"ASB-A-505748392-e3352ca9"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-505748392.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/5234b8c33e63286bdb382992acdcaa440da01be0","target":{"file":"libs/androidfw/ZipFileRO.cpp"},"deprecated":false,"digest":{"line_hashes":["255273107764280999950999932921386056299","200770063162390918579106892912898843566","127628624804953613033083286504704442189","10770843555836785776292486916865778428","148386236082038627021727118362863878045","229865868111145925047752915818625423152"],"threshold":0.9},"id":"ASB-A-505748392-36b68b42","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5234b8c33e63286bdb382992acdcaa440da01be0","target":{"file":"libs/androidfw/include/androidfw/ZipFileRO.h"},"deprecated":false,"digest":{"line_hashes":["217393691783784062743186263382289736587","251243380099684899172006670758014669102","160757615909430888168392578688260034243"],"threshold":0.9},"id":"ASB-A-505748392-3ed9d8ed","signature_type":"Line"},{"deprecated":false,"digest":{"length":405,"function_hash":"194482363648532907574043945036591750697"},"id":"ASB-A-505748392-b8263e72","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5234b8c33e63286bdb382992acdcaa440da01be0","target":{"function":"ZipFileRO::getEntryFileName","file":"libs/androidfw/ZipFileRO.cpp"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/5234b8c33e63286bdb382992acdcaa440da01be0"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-505748392.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/46e98295d82f24f7f61fe38040a29521b036e7ea","target":{"file":"libs/androidfw/ZipFileRO.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["255273107764280999950999932921386056299","200770063162390918579106892912898843566","127628624804953613033083286504704442189","10770843555836785776292486916865778428","148386236082038627021727118362863878045","229865868111145925047752915818625423152"]},"id":"ASB-A-505748392-6a233ecc"},{"id":"ASB-A-505748392-7577ff03","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/46e98295d82f24f7f61fe38040a29521b036e7ea","target":{"file":"libs/androidfw/include/androidfw/ZipFileRO.h"},"deprecated":false,"digest":{"line_hashes":["217393691783784062743186263382289736587","251243380099684899172006670758014669102","160757615909430888168392578688260034243"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/46e98295d82f24f7f61fe38040a29521b036e7ea","target":{"file":"libs/androidfw/ZipFileRO.cpp","function":"ZipFileRO::getEntryFileName"},"deprecated":false,"digest":{"function_hash":"194482363648532907574043945036591750697","length":405},"id":"ASB-A-505748392-d4dcb07e"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/46e98295d82f24f7f61fe38040a29521b036e7ea"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-505748392.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/770a5c19cfaf537a57947f5f919cdca26e018eef","target":{"file":"libs/androidfw/ZipFileRO.cpp","function":"ZipFileRO::getEntryFileName"},"deprecated":false,"digest":{"function_hash":"194482363648532907574043945036591750697","length":405},"id":"ASB-A-505748392-87cfb738","signature_type":"Function"},{"target":{"file":"libs/androidfw/ZipFileRO.cpp"},"deprecated":false,"digest":{"line_hashes":["255273107764280999950999932921386056299","200770063162390918579106892912898843566","127628624804953613033083286504704442189","10770843555836785776292486916865778428","148386236082038627021727118362863878045","229865868111145925047752915818625423152"],"threshold":0.9},"id":"ASB-A-505748392-b5c1d783","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/770a5c19cfaf537a57947f5f919cdca26e018eef"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/770a5c19cfaf537a57947f5f919cdca26e018eef","target":{"file":"libs/androidfw/include/androidfw/ZipFileRO.h"},"deprecated":false,"digest":{"line_hashes":["217393691783784062743186263382289736587","251243380099684899172006670758014669102","160757615909430888168392578688260034243"],"threshold":0.9},"id":"ASB-A-505748392-c4abb6ec","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/770a5c19cfaf537a57947f5f919cdca26e018eef"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-505748392.json"}}],"schema_version":"1.9.2"}