{"id":"ASB-A-511821731","details":"In multiple functions, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-511821731","CVE-2026-49918"],"modified":"2026-09-09T15:15:54.249544283Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/external/libcupsfilters","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"digest":{"length":22064,"function_hash":"172705240091654816194339972220987382698"},"id":"ASB-A-511821731-1b8dd9d6","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libcupsfilters/+/600ee202819ff619ffef4069a7d6e6d862828442","target":{"function":"out_page","file":"cupsfilters/pwgtoraster.c"},"deprecated":false},{"deprecated":false,"digest":{"length":4354,"function_hash":"218494290827324000524534858525851077403"},"id":"ASB-A-511821731-49540be2","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libcupsfilters/+/600ee202819ff619ffef4069a7d6e6d862828442","target":{"function":"cfRasterSetColorSpace","file":"cupsfilters/raster.c"}},{"id":"ASB-A-511821731-5572e4c4","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libcupsfilters/+/600ee202819ff619ffef4069a7d6e6d862828442","target":{"file":"cupsfilters/imagetoraster.c"},"deprecated":false,"digest":{"line_hashes":["286940995536061256983145668487887787651","318220239952617257761236513284780622886","202219165910144910497813257208064243548","72653656246086581489608105542568454275","209821297468708834973088056455793085322","195679268196383995658288004172319765350","214739178074388982758888013915096500970","288342305341793160895383886500118700436","52912204216922154796669925998757613786","100128110123076449840968165065788450049","310095948672532923181791016448010128981","10127626629076048357499429208984340238"],"threshold":0.9}},{"source":"https://android.googlesource.com/platform/external/libcupsfilters/+/600ee202819ff619ffef4069a7d6e6d862828442","target":{"function":"cfFilterImageToRaster","file":"cupsfilters/imagetoraster.c"},"deprecated":false,"digest":{"function_hash":"211746030216377734068515634714422645364","length":34521},"id":"ASB-A-511821731-5944166e","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libcupsfilters/+/600ee202819ff619ffef4069a7d6e6d862828442","target":{"file":"cupsfilters/raster.c"},"deprecated":false,"digest":{"line_hashes":["161241050013221359755585750190350435863","238582997695624812398804282979072694453","276770579587674945528883835642063197049","295089443801985902631088399088231462227","38233012377960220329291081884831524521","244805454899891787808497418112865386197","267216177946666879378796459637149344341","259317987099181773195073738187220661665","276861560703538767704438271873635403297","314818333577706886505071975165005060623","32488104705338724253832824120331890430","10687573512176674227931654520934871037","34262976792819183423771610384720266791","246168895429023874844374306159037577508"],"threshold":0.9},"id":"ASB-A-511821731-6c3f9d08"},{"digest":{"function_hash":"78632532774089528210682218911866643198","length":8856},"id":"ASB-A-511821731-7a17259e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libcupsfilters/+/600ee202819ff619ffef4069a7d6e6d862828442","target":{"file":"cupsfilters/raster.c","function":"cfRasterPrepareHeader"},"deprecated":false},{"target":{"file":"cupsfilters/pwgtoraster.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["194688416331460594059850966744319048865","99521633175145743581345027265443436456","274177674319848221523929278457349215339","125599779384998519713479716427037945753","42667796877492303003724735429559672540","328452854945950543944068166415048994679","105202030296060485647442823907743140909","290119733626958793342019246787541235924","74072657954959684236831719648795509024","229088568190036877637494090296413999920","197807550229866634022707230437113502537","197033632275660922140636361588951718595","94794485793257313546952911180345156054","222850179697902734554667014743580142020","148427668034168565904590801122716057617","116847087958116398701314944373351306450","321931183811313153438182131798355540600","165926653925939523833954265112784728381","65176989134890647788006298159697629023","156265450427090533925538750202601242065","272698594400961572022788731351909216328","213769534540087836018725912930404937664","5202803568972068895178330979810482352","230964298219163379532665575882003784131","274086140779684201830788367308011801041","869400991638176892740081911389680037","189454774142254224369186181617260827338","145708620872850408291412201693490204459","7977479934805283073504897274264880071","249093226241003640409869680895022752368","20893685742284800828431230082724373842","68451184621633938766353389324439018050","339177316258991224642174700564301512535","322874952593877061746510742146596316311","329887434476946315496425679925197260342","11071285130998237968531405777899222857","267510906415411870718331994243597614474","7698242634051921879943938466279585589","184670659250061083878604554480312841566","161906499956140636648793089169153436000","278439185250133688919766383885486699601","318119147717870644354838129295755522309"]},"id":"ASB-A-511821731-a8e92ee0","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libcupsfilters/+/600ee202819ff619ffef4069a7d6e6d862828442"}],"fixes":["https://android.googlesource.com/platform/external/libcupsfilters/+/600ee202819ff619ffef4069a7d6e6d862828442"],"severity":"Critical"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-511821731.json"}},{"package":{"name":"platform/external/libcupsfilters","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/libcupsfilters/+/f5245758e156c04c7adb0bea019b7311de00453a"],"severity":"Critical","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-511821731-61341319","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libcupsfilters/+/f5245758e156c04c7adb0bea019b7311de00453a","target":{"function":"cfRasterSetColorSpace","file":"cupsfilters/raster.c"},"deprecated":false,"digest":{"length":4354,"function_hash":"218494290827324000524534858525851077403"}},{"digest":{"function_hash":"172705240091654816194339972220987382698","length":22064},"id":"ASB-A-511821731-6e426780","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libcupsfilters/+/f5245758e156c04c7adb0bea019b7311de00453a","target":{"function":"out_page","file":"cupsfilters/pwgtoraster.c"},"deprecated":false},{"digest":{"threshold":0.9,"line_hashes":["286940995536061256983145668487887787651","318220239952617257761236513284780622886","202219165910144910497813257208064243548","72653656246086581489608105542568454275","209821297468708834973088056455793085322","195679268196383995658288004172319765350","214739178074388982758888013915096500970","288342305341793160895383886500118700436","52912204216922154796669925998757613786","100128110123076449840968165065788450049","310095948672532923181791016448010128981","10127626629076048357499429208984340238"]},"id":"ASB-A-511821731-83121690","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libcupsfilters/+/f5245758e156c04c7adb0bea019b7311de00453a","target":{"file":"cupsfilters/imagetoraster.c"},"deprecated":false},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["194688416331460594059850966744319048865","99521633175145743581345027265443436456","274177674319848221523929278457349215339","125599779384998519713479716427037945753","42667796877492303003724735429559672540","328452854945950543944068166415048994679","105202030296060485647442823907743140909","290119733626958793342019246787541235924","74072657954959684236831719648795509024","229088568190036877637494090296413999920","197807550229866634022707230437113502537","197033632275660922140636361588951718595","94794485793257313546952911180345156054","222850179697902734554667014743580142020","148427668034168565904590801122716057617","116847087958116398701314944373351306450","321931183811313153438182131798355540600","165926653925939523833954265112784728381","65176989134890647788006298159697629023","156265450427090533925538750202601242065","272698594400961572022788731351909216328","213769534540087836018725912930404937664","5202803568972068895178330979810482352","230964298219163379532665575882003784131","274086140779684201830788367308011801041","869400991638176892740081911389680037","189454774142254224369186181617260827338","145708620872850408291412201693490204459","7977479934805283073504897274264880071","249093226241003640409869680895022752368","20893685742284800828431230082724373842","68451184621633938766353389324439018050","339177316258991224642174700564301512535","322874952593877061746510742146596316311","329887434476946315496425679925197260342","11071285130998237968531405777899222857","267510906415411870718331994243597614474","7698242634051921879943938466279585589","184670659250061083878604554480312841566","161906499956140636648793089169153436000","278439185250133688919766383885486699601","318119147717870644354838129295755522309"]},"id":"ASB-A-511821731-8c1295db","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libcupsfilters/+/f5245758e156c04c7adb0bea019b7311de00453a","target":{"file":"cupsfilters/pwgtoraster.c"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/external/libcupsfilters/+/f5245758e156c04c7adb0bea019b7311de00453a","target":{"file":"cupsfilters/imagetoraster.c","function":"cfFilterImageToRaster"},"deprecated":false,"digest":{"length":34521,"function_hash":"211746030216377734068515634714422645364"},"id":"ASB-A-511821731-b4466114","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/external/libcupsfilters/+/f5245758e156c04c7adb0bea019b7311de00453a","target":{"file":"cupsfilters/raster.c","function":"cfRasterPrepareHeader"},"deprecated":false,"digest":{"function_hash":"78632532774089528210682218911866643198","length":8856},"id":"ASB-A-511821731-e1b7ab95","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/external/libcupsfilters/+/f5245758e156c04c7adb0bea019b7311de00453a","target":{"file":"cupsfilters/raster.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["161241050013221359755585750190350435863","238582997695624812398804282979072694453","276770579587674945528883835642063197049","295089443801985902631088399088231462227","38233012377960220329291081884831524521","244805454899891787808497418112865386197","267216177946666879378796459637149344341","259317987099181773195073738187220661665","276861560703538767704438271873635403297","314818333577706886505071975165005060623","32488104705338724253832824120331890430","10687573512176674227931654520934871037","34262976792819183423771610384720266791","246168895429023874844374306159037577508"]},"id":"ASB-A-511821731-f12fabcb","signature_type":"Line"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-511821731.json"}},{"package":{"name":"platform/external/libcupsfilters","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/libcupsfilters/+/0af6641e33600b19020356f4e834c303b3f63071"],"severity":"Critical","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-511821731-2e72ae18","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libcupsfilters/+/0af6641e33600b19020356f4e834c303b3f63071","target":{"function":"cfRasterSetColorSpace","file":"cupsfilters/raster.c"},"deprecated":false,"digest":{"function_hash":"218494290827324000524534858525851077403","length":4354}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libcupsfilters/+/0af6641e33600b19020356f4e834c303b3f63071","target":{"file":"cupsfilters/imagetoraster.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["286940995536061256983145668487887787651","318220239952617257761236513284780622886","202219165910144910497813257208064243548","72653656246086581489608105542568454275","209821297468708834973088056455793085322","195679268196383995658288004172319765350","214739178074388982758888013915096500970","288342305341793160895383886500118700436","52912204216922154796669925998757613786","100128110123076449840968165065788450049","310095948672532923181791016448010128981","10127626629076048357499429208984340238"]},"id":"ASB-A-511821731-30639559"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libcupsfilters/+/0af6641e33600b19020356f4e834c303b3f63071","target":{"file":"cupsfilters/imagetoraster.c","function":"cfFilterImageToRaster"},"deprecated":false,"digest":{"function_hash":"211746030216377734068515634714422645364","length":34521},"id":"ASB-A-511821731-51f813f1"},{"id":"ASB-A-511821731-543327cd","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libcupsfilters/+/0af6641e33600b19020356f4e834c303b3f63071","target":{"file":"cupsfilters/pwgtoraster.c","function":"out_page"},"deprecated":false,"digest":{"length":22064,"function_hash":"172705240091654816194339972220987382698"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libcupsfilters/+/0af6641e33600b19020356f4e834c303b3f63071","target":{"file":"cupsfilters/pwgtoraster.c"},"deprecated":false,"digest":{"line_hashes":["194688416331460594059850966744319048865","99521633175145743581345027265443436456","274177674319848221523929278457349215339","125599779384998519713479716427037945753","42667796877492303003724735429559672540","328452854945950543944068166415048994679","105202030296060485647442823907743140909","290119733626958793342019246787541235924","74072657954959684236831719648795509024","229088568190036877637494090296413999920","197807550229866634022707230437113502537","197033632275660922140636361588951718595","94794485793257313546952911180345156054","222850179697902734554667014743580142020","148427668034168565904590801122716057617","116847087958116398701314944373351306450","321931183811313153438182131798355540600","165926653925939523833954265112784728381","65176989134890647788006298159697629023","156265450427090533925538750202601242065","272698594400961572022788731351909216328","213769534540087836018725912930404937664","5202803568972068895178330979810482352","230964298219163379532665575882003784131","274086140779684201830788367308011801041","869400991638176892740081911389680037","189454774142254224369186181617260827338","145708620872850408291412201693490204459","7977479934805283073504897274264880071","249093226241003640409869680895022752368","20893685742284800828431230082724373842","68451184621633938766353389324439018050","339177316258991224642174700564301512535","322874952593877061746510742146596316311","329887434476946315496425679925197260342","11071285130998237968531405777899222857","267510906415411870718331994243597614474","7698242634051921879943938466279585589","184670659250061083878604554480312841566","161906499956140636648793089169153436000","278439185250133688919766383885486699601","318119147717870644354838129295755522309"],"threshold":0.9},"id":"ASB-A-511821731-8db7536d"},{"source":"https://android.googlesource.com/platform/external/libcupsfilters/+/0af6641e33600b19020356f4e834c303b3f63071","target":{"file":"cupsfilters/raster.c","function":"cfRasterPrepareHeader"},"deprecated":false,"digest":{"length":8856,"function_hash":"78632532774089528210682218911866643198"},"id":"ASB-A-511821731-8f1d6085","signature_type":"Function","signature_version":"v1"},{"id":"ASB-A-511821731-b16b911a","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libcupsfilters/+/0af6641e33600b19020356f4e834c303b3f63071","target":{"file":"cupsfilters/raster.c"},"deprecated":false,"digest":{"line_hashes":["161241050013221359755585750190350435863","238582997695624812398804282979072694453","276770579587674945528883835642063197049","295089443801985902631088399088231462227","38233012377960220329291081884831524521","244805454899891787808497418112865386197","267216177946666879378796459637149344341","259317987099181773195073738187220661665","276861560703538767704438271873635403297","314818333577706886505071975165005060623","32488104705338724253832824120331890430","10687573512176674227931654520934871037","34262976792819183423771610384720266791","246168895429023874844374306159037577508"],"threshold":0.9}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-511821731.json"}}],"schema_version":"1.9.0"}