{"id":"ASB-A-509980995","details":"In qsort of libufdt_sysdeps_vendor.c, there is a possible out-of-bounds write due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-509980995","CVE-2026-55266"],"modified":"2026-10-05T16:41:13.302821909Z","published":"2026-10-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-10-01"}],"affected":[{"package":{"name":"platform/system/libufdt","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-10-01"}]}],"versions":["17-next"],"ecosystem_specific":{"spl":"2026-10-01","types":["DoS"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/system/libufdt/+/df9856866b8d8b19058beb8e418c588cd47c60dc","target":{"file":"sysdeps/libufdt_sysdeps_vendor.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["137993797009395550428776651770291716163","193965384120655580524755473377960841859","200024504230025755980259680530302527962","292652473577376386515723978346152089008","313098299662800207090179405850625187848","241194047026163989788690596247341648628","281524713045533723474044076505175332651","307296896859351763571935461447691248140","265717812399586917900284566277803839097","326808613316438876634975978328511266906","323255847457112314371069404249604084910","257766332763367307610507383215671412809","240655166247386861863658649374348557277"]},"id":"ASB-A-509980995-3812a1fa","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"length":2162,"function_hash":"38291949770363451779359671998067870011"},"id":"ASB-A-509980995-41fcb4e0","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/libufdt/+/df9856866b8d8b19058beb8e418c588cd47c60dc","target":{"file":"sysdeps/libufdt_sysdeps_vendor.c","function":"qsort"}}],"fixes":["https://android.googlesource.com/platform/system/libufdt/+/df9856866b8d8b19058beb8e418c588cd47c60dc"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-509980995.json"}},{"package":{"name":"platform/system/libufdt","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-10-01"}]}],"versions":["15"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/libufdt/+/63a6e6fbe0722ef270f6e804a4a86c5f1afea68b","target":{"file":"sysdeps/libufdt_sysdeps_vendor.c"},"deprecated":false,"digest":{"line_hashes":["137993797009395550428776651770291716163","193965384120655580524755473377960841859","200024504230025755980259680530302527962","292652473577376386515723978346152089008","313098299662800207090179405850625187848","241194047026163989788690596247341648628","281524713045533723474044076505175332651","307296896859351763571935461447691248140","265717812399586917900284566277803839097","326808613316438876634975978328511266906","323255847457112314371069404249604084910","257766332763367307610507383215671412809","240655166247386861863658649374348557277"],"threshold":0.9},"id":"ASB-A-509980995-83081fc3","signature_type":"Line"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/libufdt/+/63a6e6fbe0722ef270f6e804a4a86c5f1afea68b","target":{"file":"sysdeps/libufdt_sysdeps_vendor.c","function":"qsort"},"deprecated":false,"digest":{"length":2162,"function_hash":"38291949770363451779359671998067870011"},"id":"ASB-A-509980995-90eeccdf","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/system/libufdt/+/63a6e6fbe0722ef270f6e804a4a86c5f1afea68b"],"severity":"High","spl":"2026-10-01","types":["DoS"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-509980995.json"}},{"package":{"name":"platform/system/libufdt","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-10-01"}]}],"versions":["16"],"ecosystem_specific":{"spl":"2026-10-01","types":["DoS"],"vanir_signatures":[{"deprecated":false,"digest":{"length":2162,"function_hash":"38291949770363451779359671998067870011"},"id":"ASB-A-509980995-04daceab","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/libufdt/+/3ddb2cd7727cc2b7d0f5b5330aadb93aa21943ba","target":{"function":"qsort","file":"sysdeps/libufdt_sysdeps_vendor.c"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/libufdt/+/3ddb2cd7727cc2b7d0f5b5330aadb93aa21943ba","target":{"file":"sysdeps/libufdt_sysdeps_vendor.c"},"deprecated":false,"digest":{"line_hashes":["137993797009395550428776651770291716163","193965384120655580524755473377960841859","200024504230025755980259680530302527962","292652473577376386515723978346152089008","313098299662800207090179405850625187848","241194047026163989788690596247341648628","281524713045533723474044076505175332651","307296896859351763571935461447691248140","265717812399586917900284566277803839097","326808613316438876634975978328511266906","323255847457112314371069404249604084910","257766332763367307610507383215671412809","240655166247386861863658649374348557277"],"threshold":0.9},"id":"ASB-A-509980995-5267d152","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/system/libufdt/+/3ddb2cd7727cc2b7d0f5b5330aadb93aa21943ba"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-509980995.json"}},{"package":{"name":"platform/system/libufdt","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-10-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/libufdt/+/2de0d867217447eb281ee4fb775fa8a04d6f1b9a"],"severity":"High","spl":"2026-10-01","types":["DoS"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/libufdt/+/2de0d867217447eb281ee4fb775fa8a04d6f1b9a","target":{"function":"qsort","file":"sysdeps/libufdt_sysdeps_vendor.c"},"deprecated":false,"digest":{"length":2162,"function_hash":"38291949770363451779359671998067870011"},"id":"ASB-A-509980995-5f419eb5","signature_type":"Function"},{"source":"https://android.googlesource.com/platform/system/libufdt/+/2de0d867217447eb281ee4fb775fa8a04d6f1b9a","target":{"file":"sysdeps/libufdt_sysdeps_vendor.c"},"deprecated":false,"digest":{"line_hashes":["137993797009395550428776651770291716163","193965384120655580524755473377960841859","200024504230025755980259680530302527962","292652473577376386515723978346152089008","313098299662800207090179405850625187848","241194047026163989788690596247341648628","281524713045533723474044076505175332651","307296896859351763571935461447691248140","265717812399586917900284566277803839097","326808613316438876634975978328511266906","323255847457112314371069404249604084910","257766332763367307610507383215671412809","240655166247386861863658649374348557277"],"threshold":0.9},"id":"ASB-A-509980995-e75a06cf","signature_type":"Line","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-509980995.json"}},{"package":{"name":"platform/system/libufdt","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-10-01"}]}],"versions":["17"],"ecosystem_specific":{"severity":"High","spl":"2026-10-01","types":["DoS"],"vanir_signatures":[{"digest":{"length":2162,"function_hash":"38291949770363451779359671998067870011"},"id":"ASB-A-509980995-47019493","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/libufdt/+/90b1784cced8f5d1834a87dbf6fa8e1e74ef5448","target":{"file":"sysdeps/libufdt_sysdeps_vendor.c","function":"qsort"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/libufdt/+/90b1784cced8f5d1834a87dbf6fa8e1e74ef5448","target":{"file":"sysdeps/libufdt_sysdeps_vendor.c"},"deprecated":false,"digest":{"line_hashes":["137993797009395550428776651770291716163","193965384120655580524755473377960841859","200024504230025755980259680530302527962","292652473577376386515723978346152089008","313098299662800207090179405850625187848","241194047026163989788690596247341648628","281524713045533723474044076505175332651","307296896859351763571935461447691248140","265717812399586917900284566277803839097","326808613316438876634975978328511266906","323255847457112314371069404249604084910","257766332763367307610507383215671412809","240655166247386861863658649374348557277"],"threshold":0.9},"id":"ASB-A-509980995-50165515"}],"fixes":["https://android.googlesource.com/platform/system/libufdt/+/90b1784cced8f5d1834a87dbf6fa8e1e74ef5448"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-509980995.json"}},{"package":{"name":"platform/system/libufdt","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-10-01"}]}],"versions":["14"],"ecosystem_specific":{"types":["DoS"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/libufdt/+/72740bf01100c7cbd40e1d0fc9e25c17c5a60be0","target":{"file":"sysdeps/libufdt_sysdeps_vendor.c"},"deprecated":false,"digest":{"line_hashes":["137993797009395550428776651770291716163","193965384120655580524755473377960841859","200024504230025755980259680530302527962","292652473577376386515723978346152089008","313098299662800207090179405850625187848","241194047026163989788690596247341648628","281524713045533723474044076505175332651","307296896859351763571935461447691248140","265717812399586917900284566277803839097","326808613316438876634975978328511266906","323255847457112314371069404249604084910","257766332763367307610507383215671412809","240655166247386861863658649374348557277"],"threshold":0.9},"id":"ASB-A-509980995-0ce7ad58","signature_type":"Line"},{"source":"https://android.googlesource.com/platform/system/libufdt/+/72740bf01100c7cbd40e1d0fc9e25c17c5a60be0","target":{"file":"sysdeps/libufdt_sysdeps_vendor.c","function":"qsort"},"deprecated":false,"digest":{"function_hash":"38291949770363451779359671998067870011","length":2162},"id":"ASB-A-509980995-d8bc2ef7","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/system/libufdt/+/72740bf01100c7cbd40e1d0fc9e25c17c5a60be0"],"severity":"High","spl":"2026-10-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-509980995.json"}}],"schema_version":"1.9.0"}