{"id":"ASB-A-511027559","details":"In _mupdf_get_hdr of wprint_mupdf.c, there is a possible out-of-bounds read due to an integer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-511027559","CVE-2026-58971"],"modified":"2026-11-02T17:11:20.139272808Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/packages/services/BuiltInPrintService","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/b6713d1d8eb2ef1e849ffc1515a22060dfc0aa08"],"severity":"High","spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"target":{"file":"jni/plugins/wprint_mupdf.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["70890059489381995223447480361572929400","152910325076878944017163361295669773563","66745323530701889742427830252937602664","214124734274702917689036114572604778818","96072615365680069335123790765281615175","108109869446004621987170202437834959054","175531176060099106315306743602499217653","72441533145274799146786960310720208542","312562347944266644490681309344297487744","102390037832932510917291331746567850141","32697436279445176093768764643881648918","245971560149871095867795937927879503097","186657894465543112027955779441595328312","129254052245414511681057692473008170775","230365826727050830592787102685066255205","57352815319959337815356600169478868769"]},"id":"ASB-A-511027559-dee7732f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/b6713d1d8eb2ef1e849ffc1515a22060dfc0aa08"},{"source":"https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/b6713d1d8eb2ef1e849ffc1515a22060dfc0aa08","target":{"function":"_mupdf_get_hdr","file":"jni/plugins/wprint_mupdf.c"},"deprecated":false,"digest":{"function_hash":"184905360186362463633135203434778027740","length":1480},"id":"ASB-A-511027559-f5ae212e","signature_type":"Function","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-511027559.json"}},{"package":{"name":"platform/packages/services/BuiltInPrintService","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/83aa789a2c2a899659d674ad715c6256bae59cb7","target":{"file":"jni/plugins/wprint_mupdf.c","function":"_mupdf_get_hdr"},"deprecated":false,"digest":{"function_hash":"112611109829120563780641392135632811056","length":1387},"id":"ASB-A-511027559-4ae532dc","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["70890059489381995223447480361572929400","152910325076878944017163361295669773563","66745323530701889742427830252937602664","214124734274702917689036114572604778818","96072615365680069335123790765281615175","108109869446004621987170202437834959054","175531176060099106315306743602499217653","72441533145274799146786960310720208542","312562347944266644490681309344297487744","102390037832932510917291331746567850141","32697436279445176093768764643881648918","245971560149871095867795937927879503097","186657894465543112027955779441595328312","129254052245414511681057692473008170775","230365826727050830592787102685066255205","57352815319959337815356600169478868769"],"threshold":0.9},"id":"ASB-A-511027559-d7641320","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/83aa789a2c2a899659d674ad715c6256bae59cb7","target":{"file":"jni/plugins/wprint_mupdf.c"}}],"fixes":["https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/83aa789a2c2a899659d674ad715c6256bae59cb7"],"severity":"High","spl":"2026-11-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-511027559.json"}},{"package":{"name":"platform/packages/services/BuiltInPrintService","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/cbc7eca5bf532747735c5b426e6e6f729774c99e","target":{"file":"jni/plugins/wprint_mupdf.c","function":"_mupdf_get_hdr"},"deprecated":false,"digest":{"function_hash":"112611109829120563780641392135632811056","length":1387},"id":"ASB-A-511027559-828c6c02","signature_type":"Function","signature_version":"v1"},{"id":"ASB-A-511027559-d4721e2d","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/cbc7eca5bf532747735c5b426e6e6f729774c99e","target":{"file":"jni/plugins/wprint_mupdf.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["70890059489381995223447480361572929400","152910325076878944017163361295669773563","66745323530701889742427830252937602664","214124734274702917689036114572604778818","96072615365680069335123790765281615175","108109869446004621987170202437834959054","175531176060099106315306743602499217653","72441533145274799146786960310720208542","312562347944266644490681309344297487744","102390037832932510917291331746567850141","32697436279445176093768764643881648918","245971560149871095867795937927879503097","186657894465543112027955779441595328312","129254052245414511681057692473008170775","230365826727050830592787102685066255205","57352815319959337815356600169478868769"]}}],"fixes":["https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/cbc7eca5bf532747735c5b426e6e6f729774c99e"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-511027559.json"}},{"package":{"name":"platform/packages/services/BuiltInPrintService","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"deprecated":false,"digest":{"length":1387,"function_hash":"112611109829120563780641392135632811056"},"id":"ASB-A-511027559-1d4725f3","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/6965b7c7f1d07146242c2c682f3ca5c6eeb5db66","target":{"function":"_mupdf_get_hdr","file":"jni/plugins/wprint_mupdf.c"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/6965b7c7f1d07146242c2c682f3ca5c6eeb5db66","target":{"file":"jni/plugins/wprint_mupdf.c"},"deprecated":false,"digest":{"line_hashes":["70890059489381995223447480361572929400","152910325076878944017163361295669773563","66745323530701889742427830252937602664","214124734274702917689036114572604778818","96072615365680069335123790765281615175","108109869446004621987170202437834959054","175531176060099106315306743602499217653","72441533145274799146786960310720208542","312562347944266644490681309344297487744","102390037832932510917291331746567850141","32697436279445176093768764643881648918","245971560149871095867795937927879503097","186657894465543112027955779441595328312","129254052245414511681057692473008170775","230365826727050830592787102685066255205","57352815319959337815356600169478868769"],"threshold":0.9},"id":"ASB-A-511027559-9944ee7c","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/6965b7c7f1d07146242c2c682f3ca5c6eeb5db66"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-511027559.json"}},{"package":{"name":"platform/packages/services/BuiltInPrintService","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"digest":{"function_hash":"184905360186362463633135203434778027740","length":1480},"id":"ASB-A-511027559-0ac17c7a","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/d8f19bd3ba84678ae638b5552a11dd9e6a9bbfff","target":{"function":"_mupdf_get_hdr","file":"jni/plugins/wprint_mupdf.c"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/d8f19bd3ba84678ae638b5552a11dd9e6a9bbfff","target":{"file":"jni/plugins/wprint_mupdf.c"},"deprecated":false,"digest":{"line_hashes":["70890059489381995223447480361572929400","152910325076878944017163361295669773563","66745323530701889742427830252937602664","214124734274702917689036114572604778818","96072615365680069335123790765281615175","108109869446004621987170202437834959054","175531176060099106315306743602499217653","72441533145274799146786960310720208542","312562347944266644490681309344297487744","102390037832932510917291331746567850141","32697436279445176093768764643881648918","245971560149871095867795937927879503097","186657894465543112027955779441595328312","129254052245414511681057692473008170775","230365826727050830592787102685066255205","57352815319959337815356600169478868769"],"threshold":0.9},"id":"ASB-A-511027559-62228981","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/d8f19bd3ba84678ae638b5552a11dd9e6a9bbfff"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-511027559.json"}},{"package":{"name":"platform/packages/services/BuiltInPrintService","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/b77b85040bf1e54c5b0f8e90098dbc3daf104e38","target":{"file":"jni/plugins/wprint_mupdf.c"},"deprecated":false,"digest":{"line_hashes":["70890059489381995223447480361572929400","152910325076878944017163361295669773563","66745323530701889742427830252937602664","214124734274702917689036114572604778818","96072615365680069335123790765281615175","108109869446004621987170202437834959054","175531176060099106315306743602499217653","72441533145274799146786960310720208542","312562347944266644490681309344297487744","102390037832932510917291331746567850141","32697436279445176093768764643881648918","245971560149871095867795937927879503097","186657894465543112027955779441595328312","129254052245414511681057692473008170775","230365826727050830592787102685066255205","57352815319959337815356600169478868769"],"threshold":0.9},"id":"ASB-A-511027559-49a128c8","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"112611109829120563780641392135632811056","length":1387},"id":"ASB-A-511027559-5a57c9be","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/b77b85040bf1e54c5b0f8e90098dbc3daf104e38","target":{"function":"_mupdf_get_hdr","file":"jni/plugins/wprint_mupdf.c"}}],"fixes":["https://android.googlesource.com/platform/packages/services/BuiltInPrintService/+/b77b85040bf1e54c5b0f8e90098dbc3daf104e38"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-511027559.json"}}],"schema_version":"1.9.2"}