{"id":"ASB-A-511640905","details":"In multiple locations, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-511640905","CVE-2026-49927"],"modified":"2026-11-10T17:02:23.040266809Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/external/libppd/+/6ce8492f2566a35e79afd0f159be7acebe124863"}],"affected":[{"package":{"name":"platform/external/libppd","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/libppd/+/6a68ec5827c47b489ad6c0d618539a03b6c4a030"],"severity":"Critical","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libppd/+/6a68ec5827c47b489ad6c0d618539a03b6c4a030","target":{"file":"ppd/rastertops.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["44962297997072222622375396097813682821","164264004405122618038050854423345254234","6778137727039842854886473269356173672","265755248766355260897528772220591114886","132712056677079736849410988621362333101","317590831915478151555486627880931226573","149140458925552025632630900349852288683","83449300026991262329504972378475761730","143041578655113405103429180972162157138","305407763440932820003256330882568300067","93479294958980798401718299045807293476","259361055327899273627568293976031866903","28485716057795232161982779768457807622","274389170064040651359436879652360415622","200019564112221352489723085804787941301","248844137173347591191974375237355852261","137891444674319826360103050437204065963","73261245257832340828033198585741960517","93750584975079018549646025536301152369","44226574710248510626374563691948921313","140750894555880093206577899356388436349","185124880526862421682510845869896189112","314024136004694084723184536256454606040","140996258581963537661696372929836892819","174046961242012198480516570854247799696","95834746310349108125722994501444863453","150150234466187364348703924722998157182","1636238584027049840760210053154007782","269614017045588465491934725569401917228","192892397163153819810535910386765109387","272505493988343909666026694431948221700","180040678522464252556605713786681660192","244816998064406296735488648170330871125","84671068386367939730233034188605699686","293335696134146982172153782793267851768","245228774914010555778037437050731198498","215163055808463799818651579089071589573","26629796998428145775479357615050466741","17753640040339776529073322611258009608","188885668344785179899624334907766438179","89835156156898083904384321607776812323","157669049970530960895958433281264304328","13183011660932568516168525724752344213","266908730079764000691795393790786324496","32916890398679569823925043279563207625"]},"id":"ASB-A-511640905-32cfc4bc"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/external/libppd/+/6a68ec5827c47b489ad6c0d618539a03b6c4a030","target":{"file":"ppd/raster-interpret.c","function":"ppdRasterInterpretPPD"},"deprecated":false,"digest":{"function_hash":"270111412181754467997058809460146568783","length":7487},"id":"ASB-A-511640905-a653dc96","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/external/libppd/+/6a68ec5827c47b489ad6c0d618539a03b6c4a030","target":{"file":"ppd/raster-interpret.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["228884931509736023321532316863439408865","245512546130279032922794780264240231926","298283364229518929812621197046250507758","153326455306784906433253102389338208927","183137496727969299268926065148625726746","245800676463951503304064034439803017611","267216177946666879378796459637149344341","302150254281362373215589120753786553116","56128546118176275440813259845577860822","221130564534015479928979479905761480630"]},"id":"ASB-A-511640905-b3b59ea7","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libppd/+/6a68ec5827c47b489ad6c0d618539a03b6c4a030","target":{"function":"write_flate","file":"ppd/rastertops.c"},"deprecated":false,"digest":{"length":1693,"function_hash":"112084852496166372237690221632010885140"},"id":"ASB-A-511640905-da3dfc1c"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-511640905.json"}},{"package":{"name":"platform/external/libppd","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"target":{"file":"ppd/rastertops.c","function":"write_flate"},"deprecated":false,"digest":{"function_hash":"112084852496166372237690221632010885140","length":1693},"id":"ASB-A-511640905-03a81e14","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libppd/+/b7ce2bd04ef6f88695677d700b4e2fd2385eebff"},{"id":"ASB-A-511640905-5a28587a","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libppd/+/b7ce2bd04ef6f88695677d700b4e2fd2385eebff","target":{"file":"ppd/raster-interpret.c"},"deprecated":false,"digest":{"line_hashes":["228884931509736023321532316863439408865","245512546130279032922794780264240231926","298283364229518929812621197046250507758","153326455306784906433253102389338208927","183137496727969299268926065148625726746","245800676463951503304064034439803017611","267216177946666879378796459637149344341","302150254281362373215589120753786553116","56128546118176275440813259845577860822","221130564534015479928979479905761480630"],"threshold":0.9}},{"target":{"file":"ppd/raster-interpret.c","function":"ppdRasterInterpretPPD"},"deprecated":false,"digest":{"function_hash":"270111412181754467997058809460146568783","length":7487},"id":"ASB-A-511640905-b11f0dea","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libppd/+/b7ce2bd04ef6f88695677d700b4e2fd2385eebff"},{"target":{"file":"ppd/rastertops.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["44962297997072222622375396097813682821","164264004405122618038050854423345254234","6778137727039842854886473269356173672","265755248766355260897528772220591114886","132712056677079736849410988621362333101","317590831915478151555486627880931226573","149140458925552025632630900349852288683","83449300026991262329504972378475761730","143041578655113405103429180972162157138","305407763440932820003256330882568300067","93479294958980798401718299045807293476","259361055327899273627568293976031866903","28485716057795232161982779768457807622","274389170064040651359436879652360415622","200019564112221352489723085804787941301","248844137173347591191974375237355852261","137891444674319826360103050437204065963","73261245257832340828033198585741960517","93750584975079018549646025536301152369","44226574710248510626374563691948921313","140750894555880093206577899356388436349","185124880526862421682510845869896189112","314024136004694084723184536256454606040","140996258581963537661696372929836892819","174046961242012198480516570854247799696","95834746310349108125722994501444863453","150150234466187364348703924722998157182","1636238584027049840760210053154007782","269614017045588465491934725569401917228","192892397163153819810535910386765109387","272505493988343909666026694431948221700","180040678522464252556605713786681660192","244816998064406296735488648170330871125","84671068386367939730233034188605699686","293335696134146982172153782793267851768","245228774914010555778037437050731198498","215163055808463799818651579089071589573","26629796998428145775479357615050466741","17753640040339776529073322611258009608","188885668344785179899624334907766438179","89835156156898083904384321607776812323","157669049970530960895958433281264304328","13183011660932568516168525724752344213","266908730079764000691795393790786324496","32916890398679569823925043279563207625"]},"id":"ASB-A-511640905-c21674f6","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libppd/+/b7ce2bd04ef6f88695677d700b4e2fd2385eebff"}],"fixes":["https://android.googlesource.com/platform/external/libppd/+/b7ce2bd04ef6f88695677d700b4e2fd2385eebff"],"severity":"Critical","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-511640905.json"}},{"package":{"name":"platform/external/libppd","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["228884931509736023321532316863439408865","245512546130279032922794780264240231926","298283364229518929812621197046250507758","153326455306784906433253102389338208927","183137496727969299268926065148625726746","245800676463951503304064034439803017611","267216177946666879378796459637149344341","302150254281362373215589120753786553116","56128546118176275440813259845577860822","221130564534015479928979479905761480630"]},"id":"ASB-A-511640905-2142a534","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libppd/+/000552a27da68d87c1151ea00d06b82cd0a06a07","target":{"file":"ppd/raster-interpret.c"},"deprecated":false},{"source":"https://android.googlesource.com/platform/external/libppd/+/000552a27da68d87c1151ea00d06b82cd0a06a07","target":{"file":"ppd/raster-interpret.c","function":"ppdRasterInterpretPPD"},"deprecated":false,"digest":{"length":7487,"function_hash":"270111412181754467997058809460146568783"},"id":"ASB-A-511640905-80c894a6","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libppd/+/000552a27da68d87c1151ea00d06b82cd0a06a07","target":{"file":"ppd/rastertops.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["44962297997072222622375396097813682821","164264004405122618038050854423345254234","6778137727039842854886473269356173672","265755248766355260897528772220591114886","132712056677079736849410988621362333101","317590831915478151555486627880931226573","149140458925552025632630900349852288683","83449300026991262329504972378475761730","143041578655113405103429180972162157138","305407763440932820003256330882568300067","93479294958980798401718299045807293476","259361055327899273627568293976031866903","28485716057795232161982779768457807622","274389170064040651359436879652360415622","200019564112221352489723085804787941301","248844137173347591191974375237355852261","137891444674319826360103050437204065963","73261245257832340828033198585741960517","93750584975079018549646025536301152369","44226574710248510626374563691948921313","140750894555880093206577899356388436349","185124880526862421682510845869896189112","314024136004694084723184536256454606040","140996258581963537661696372929836892819","174046961242012198480516570854247799696","95834746310349108125722994501444863453","150150234466187364348703924722998157182","1636238584027049840760210053154007782","269614017045588465491934725569401917228","192892397163153819810535910386765109387","272505493988343909666026694431948221700","180040678522464252556605713786681660192","244816998064406296735488648170330871125","84671068386367939730233034188605699686","293335696134146982172153782793267851768","245228774914010555778037437050731198498","215163055808463799818651579089071589573","26629796998428145775479357615050466741","17753640040339776529073322611258009608","188885668344785179899624334907766438179","89835156156898083904384321607776812323","157669049970530960895958433281264304328","13183011660932568516168525724752344213","266908730079764000691795393790786324496","32916890398679569823925043279563207625"]},"id":"ASB-A-511640905-b62860d8"},{"digest":{"length":1693,"function_hash":"112084852496166372237690221632010885140"},"id":"ASB-A-511640905-ce94a607","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libppd/+/000552a27da68d87c1151ea00d06b82cd0a06a07","target":{"file":"ppd/rastertops.c","function":"write_flate"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/external/libppd/+/000552a27da68d87c1151ea00d06b82cd0a06a07"],"severity":"Critical","spl":"2026-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-511640905.json"}}],"schema_version":"1.9.2"}