{"id":"ASB-A-508645975","details":"In read_boot_region of fsck.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-508645975","CVE-2026-45531"],"modified":"2026-09-09T15:15:54.249544283Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/external/exfatprogs","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/exfatprogs/+/9befb98273053c48f9b0df810090f4c88e42706a","target":{"file":"fsck/fsck.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["239173071662298255716142812658643923587","262547171917958898942687357641403931194","19378334853622804935072833962325611255","331025459896857990530159640954809112957","906465027296410640347739555479424737","25667213137200560908221445515658269625","2577201702627207203063390374630857304","294595818912909910631384237082326157993"]},"id":"ASB-A-508645975-4648e27d"},{"digest":{"function_hash":"282313106796884784920013341684254475791","length":2016},"id":"ASB-A-508645975-8dc06345","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/exfatprogs/+/9befb98273053c48f9b0df810090f4c88e42706a","target":{"function":"read_boot_region","file":"fsck/fsck.c"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/external/exfatprogs/+/2bf87d7f951961b022139fca985c0c8b5827ac94","https://android.googlesource.com/platform/external/exfatprogs/+/9befb98273053c48f9b0df810090f4c88e42706a"],"severity":"Critical","spl":"2026-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508645975.json"}},{"package":{"name":"platform/external/exfatprogs","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"digest":{"function_hash":"276426884122515798042891153674165648095","length":1892},"id":"ASB-A-508645975-3c18335e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/exfatprogs/+/ad862652cb7857d17573a38866001c8d70b69ae2","target":{"function":"read_boot_region","file":"fsck/fsck.c"},"deprecated":false},{"target":{"file":"fsck/fsck.c"},"deprecated":false,"digest":{"line_hashes":["239173071662298255716142812658643923587","262547171917958898942687357641403931194","19378334853622804935072833962325611255","331025459896857990530159640954809112957","906465027296410640347739555479424737","119087100232855696952412457140563575036","222243598848881879505027367497757745970","118182753687192589432141294774845102710"],"threshold":0.9},"id":"ASB-A-508645975-91096e00","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/exfatprogs/+/ad862652cb7857d17573a38866001c8d70b69ae2"}],"fixes":["https://android.googlesource.com/platform/external/exfatprogs/+/ad862652cb7857d17573a38866001c8d70b69ae2","https://android.googlesource.com/platform/external/exfatprogs/+/3b72fcda3398689a679cbeb7ec83c6d29d5ad647"],"severity":"Critical","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508645975.json"}},{"package":{"name":"platform/external/exfatprogs","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"Critical","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-508645975-179cff34","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/exfatprogs/+/02239bf8a11bde23b276c5201040dc3fbb22c9f7","target":{"function":"read_boot_region","file":"fsck/fsck.c"},"deprecated":false,"digest":{"length":1892,"function_hash":"276426884122515798042891153674165648095"}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["239173071662298255716142812658643923587","262547171917958898942687357641403931194","19378334853622804935072833962325611255","331025459896857990530159640954809112957","906465027296410640347739555479424737","119087100232855696952412457140563575036","222243598848881879505027367497757745970","118182753687192589432141294774845102710"]},"id":"ASB-A-508645975-ac525bec","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/exfatprogs/+/02239bf8a11bde23b276c5201040dc3fbb22c9f7","target":{"file":"fsck/fsck.c"}}],"fixes":["https://android.googlesource.com/platform/external/exfatprogs/+/6cef2730178d874d35739927a9c587e8b8ee5555","https://android.googlesource.com/platform/external/exfatprogs/+/02239bf8a11bde23b276c5201040dc3fbb22c9f7"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508645975.json"}},{"package":{"name":"platform/external/exfatprogs","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/exfatprogs/+/114dcd579fc350f989407d3f09a22a467f3c1e52","target":{"file":"fsck/fsck.c","function":"read_boot_region"},"deprecated":false,"digest":{"function_hash":"282313106796884784920013341684254475791","length":2016},"id":"ASB-A-508645975-32a409e1"},{"source":"https://android.googlesource.com/platform/external/exfatprogs/+/114dcd579fc350f989407d3f09a22a467f3c1e52","target":{"file":"fsck/fsck.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["239173071662298255716142812658643923587","262547171917958898942687357641403931194","19378334853622804935072833962325611255","331025459896857990530159640954809112957","906465027296410640347739555479424737","25667213137200560908221445515658269625","2577201702627207203063390374630857304","294595818912909910631384237082326157993"]},"id":"ASB-A-508645975-5b7ac752","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/external/exfatprogs/+/114dcd579fc350f989407d3f09a22a467f3c1e52","https://android.googlesource.com/platform/external/exfatprogs/+/5ab69158fe0bab7bdb26ee1a71edd3c1e25fbd82"],"severity":"Critical","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508645975.json"}},{"package":{"name":"platform/external/exfatprogs","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"severity":"Critical","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["239173071662298255716142812658643923587","262547171917958898942687357641403931194","19378334853622804935072833962325611255","331025459896857990530159640954809112957","906465027296410640347739555479424737","25667213137200560908221445515658269625","2577201702627207203063390374630857304","294595818912909910631384237082326157993"]},"id":"ASB-A-508645975-4d8d4652","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/exfatprogs/+/e1d2ed8b2b05d88a9da15cfb7ab6ea259b5974ba","target":{"file":"fsck/fsck.c"},"deprecated":false},{"digest":{"length":2016,"function_hash":"282313106796884784920013341684254475791"},"id":"ASB-A-508645975-adb3edbe","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/exfatprogs/+/e1d2ed8b2b05d88a9da15cfb7ab6ea259b5974ba","target":{"function":"read_boot_region","file":"fsck/fsck.c"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/external/exfatprogs/+/e1d2ed8b2b05d88a9da15cfb7ab6ea259b5974ba","https://android.googlesource.com/platform/external/exfatprogs/+/2582ab4da52c242e5f2004cd0d6fff39eddf6162"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508645975.json"}},{"package":{"name":"platform/external/exfatprogs","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-09-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"Critical","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-508645975-4a20c0d4","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/exfatprogs/+/b45ed26d483a804b947288f3b8aa4132ea89b92c","target":{"file":"fsck/fsck.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["240927534968392288652672183485557265627","262547171917958898942687357641403931194","334244112117084678098761607646785449432","97752693452248825346818904821667433731","286603115447559324312163358562164610440","197916519825275386873294241838930576235","290666670051490018124488270273003858002","119087100232855696952412457140563575036","222243598848881879505027367497757745970","11735283757689884756979178790995068779"]}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/exfatprogs/+/b45ed26d483a804b947288f3b8aa4132ea89b92c","target":{"file":"fsck/fsck.c","function":"read_boot_region"},"deprecated":false,"digest":{"length":1762,"function_hash":"244409485260179762699901976017073580001"},"id":"ASB-A-508645975-d94912bb"}],"fixes":["https://android.googlesource.com/platform/external/exfatprogs/+/94e74b4f0f8596478919abcfbd64514c8bae82ac","https://android.googlesource.com/platform/external/exfatprogs/+/b45ed26d483a804b947288f3b8aa4132ea89b92c"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-508645975.json"}}],"schema_version":"1.9.0"}