{"id":"ASB-A-506109174","details":"In multiple functions of ftsmooth.c, there is a possible memory safety issue due to improper casting. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-506109174","CVE-2026-58822"],"modified":"2026-09-09T15:15:54.249544283Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/external/freetype","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"types":["RCE"],"vanir_signatures":[{"digest":{"line_hashes":["146622831831300144023853238563881627470","56388942065459399236012205610290285822","292397237868389660909710518098158009447","219570866647328190243318567981960414297","62029007458789907284789031892908044626","286912871915672633602449500751706356632"],"threshold":0.9},"id":"ASB-A-506109174-986c5bed","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/freetype/+/3256955df2f9e2f2743603f6a6fc637d1a862fc6","target":{"file":"src/smooth/ftsmooth.c"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/freetype/+/3256955df2f9e2f2743603f6a6fc637d1a862fc6","target":{"file":"src/smooth/ftsmooth.c","function":"ft_smooth_raster_lcdv"},"deprecated":false,"digest":{"function_hash":"102182539091905126291391522742479090802","length":1151},"id":"ASB-A-506109174-df78e86d"},{"target":{"function":"ft_smooth_raster_lcd","file":"src/smooth/ftsmooth.c"},"deprecated":false,"digest":{"function_hash":"215417419846574874227165714915549114949","length":1366},"id":"ASB-A-506109174-e824a576","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/freetype/+/3256955df2f9e2f2743603f6a6fc637d1a862fc6"}],"fixes":["https://android.googlesource.com/platform/external/freetype/+/3256955df2f9e2f2743603f6a6fc637d1a862fc6"],"severity":"High","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-506109174.json"}},{"package":{"name":"platform/external/freetype","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/freetype/+/d6d8fdf7c235cd52b53106fcd04078dd281f5ea9"],"severity":"High","spl":"2026-09-01","types":["RCE"],"vanir_signatures":[{"id":"ASB-A-506109174-02dfa03a","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/freetype/+/d6d8fdf7c235cd52b53106fcd04078dd281f5ea9","target":{"file":"src/smooth/ftsmooth.c","function":"ft_smooth_raster_lcdv"},"deprecated":false,"digest":{"length":1151,"function_hash":"102182539091905126291391522742479090802"}},{"id":"ASB-A-506109174-b91e4828","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/freetype/+/d6d8fdf7c235cd52b53106fcd04078dd281f5ea9","target":{"file":"src/smooth/ftsmooth.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["146622831831300144023853238563881627470","56388942065459399236012205610290285822","292397237868389660909710518098158009447","219570866647328190243318567981960414297","62029007458789907284789031892908044626","286912871915672633602449500751706356632"]}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/freetype/+/d6d8fdf7c235cd52b53106fcd04078dd281f5ea9","target":{"file":"src/smooth/ftsmooth.c","function":"ft_smooth_raster_lcd"},"deprecated":false,"digest":{"length":1366,"function_hash":"215417419846574874227165714915549114949"},"id":"ASB-A-506109174-bed7954f"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-506109174.json"}},{"package":{"name":"platform/external/freetype","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/freetype/+/2e80dfa7aa277523ef8a46e827a1be531b75702e"],"severity":"High","spl":"2026-09-01","types":["RCE"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/external/freetype/+/2e80dfa7aa277523ef8a46e827a1be531b75702e","target":{"file":"src/smooth/ftsmooth.c","function":"ft_smooth_raster_lcdv"},"deprecated":false,"digest":{"function_hash":"102182539091905126291391522742479090802","length":1151},"id":"ASB-A-506109174-19f79e02","signature_type":"Function"},{"deprecated":false,"digest":{"length":1366,"function_hash":"215417419846574874227165714915549114949"},"id":"ASB-A-506109174-4d9e65fb","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/freetype/+/2e80dfa7aa277523ef8a46e827a1be531b75702e","target":{"file":"src/smooth/ftsmooth.c","function":"ft_smooth_raster_lcd"}},{"target":{"file":"src/smooth/ftsmooth.c"},"deprecated":false,"digest":{"line_hashes":["146622831831300144023853238563881627470","56388942065459399236012205610290285822","292397237868389660909710518098158009447","219570866647328190243318567981960414297","62029007458789907284789031892908044626","286912871915672633602449500751706356632"],"threshold":0.9},"id":"ASB-A-506109174-6846f0b7","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/freetype/+/2e80dfa7aa277523ef8a46e827a1be531b75702e"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-506109174.json"}},{"package":{"name":"platform/external/freetype","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/freetype/+/21992c2fe17764cc0a0cda2428a888e075a37ddc"],"severity":"High","spl":"2026-09-01","types":["RCE"],"vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["146622831831300144023853238563881627470","56388942065459399236012205610290285822","292397237868389660909710518098158009447","219570866647328190243318567981960414297","62029007458789907284789031892908044626","286912871915672633602449500751706356632"]},"id":"ASB-A-506109174-5d213baf","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/freetype/+/21992c2fe17764cc0a0cda2428a888e075a37ddc","target":{"file":"src/smooth/ftsmooth.c"},"deprecated":false},{"digest":{"function_hash":"102182539091905126291391522742479090802","length":1151},"id":"ASB-A-506109174-824d82e9","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/freetype/+/21992c2fe17764cc0a0cda2428a888e075a37ddc","target":{"function":"ft_smooth_raster_lcdv","file":"src/smooth/ftsmooth.c"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"215417419846574874227165714915549114949","length":1366},"id":"ASB-A-506109174-d2306c77","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/freetype/+/21992c2fe17764cc0a0cda2428a888e075a37ddc","target":{"file":"src/smooth/ftsmooth.c","function":"ft_smooth_raster_lcd"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-506109174.json"}},{"package":{"name":"platform/external/freetype","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/freetype/+/0c28569cac9bf57a3b7cf57f87bdeae4d779ec36"],"severity":"High","spl":"2026-09-01","types":["RCE"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/external/freetype/+/0c28569cac9bf57a3b7cf57f87bdeae4d779ec36","target":{"file":"src/smooth/ftsmooth.c","function":"ft_smooth_raster_lcd"},"deprecated":false,"digest":{"function_hash":"215417419846574874227165714915549114949","length":1366},"id":"ASB-A-506109174-8288a785","signature_type":"Function","signature_version":"v1"},{"id":"ASB-A-506109174-837c112b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/freetype/+/0c28569cac9bf57a3b7cf57f87bdeae4d779ec36","target":{"file":"src/smooth/ftsmooth.c"},"deprecated":false,"digest":{"line_hashes":["146622831831300144023853238563881627470","56388942065459399236012205610290285822","292397237868389660909710518098158009447","219570866647328190243318567981960414297","62029007458789907284789031892908044626","286912871915672633602449500751706356632"],"threshold":0.9}},{"id":"ASB-A-506109174-d6e1c442","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/freetype/+/0c28569cac9bf57a3b7cf57f87bdeae4d779ec36","target":{"file":"src/smooth/ftsmooth.c","function":"ft_smooth_raster_lcdv"},"deprecated":false,"digest":{"function_hash":"102182539091905126291391522742479090802","length":1151}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-506109174.json"}},{"package":{"name":"platform/external/freetype","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-09-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["RCE"],"vanir_signatures":[{"id":"ASB-A-506109174-0d9428f2","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/freetype/+/c147b243ef5a603bb0bb3fcf89c6059ce367f654","target":{"file":"src/smooth/ftsmooth.c"},"deprecated":false,"digest":{"line_hashes":["146622831831300144023853238563881627470","56388942065459399236012205610290285822","249031127780233373682035083758657469812","219570866647328190243318567981960414297","62029007458789907284789031892908044626","286912871915672633602449500751706356632"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/freetype/+/c147b243ef5a603bb0bb3fcf89c6059ce367f654","target":{"file":"src/smooth/ftsmooth.c","function":"ft_smooth_raster_lcdv"},"deprecated":false,"digest":{"function_hash":"102182539091905126291391522742479090802","length":1151},"id":"ASB-A-506109174-829efef4"},{"id":"ASB-A-506109174-8cb1a341","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/freetype/+/c147b243ef5a603bb0bb3fcf89c6059ce367f654","target":{"file":"src/smooth/ftsmooth.c","function":"ft_smooth_raster_lcd"},"deprecated":false,"digest":{"function_hash":"98745190088134440164957985237078224192","length":1376}}],"fixes":["https://android.googlesource.com/platform/external/freetype/+/c147b243ef5a603bb0bb3fcf89c6059ce367f654"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-506109174.json"}}],"schema_version":"1.9.0"}