{"id":"ASB-A-513648011","details":"In validateImageInfo of Bitmap.cpp, there is a possible out-of-bounds read due to a precondition check failure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-513648011","CVE-2026-58997"],"modified":"2026-11-02T17:11:11.788091680Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/67ef036b9060552258b8caaf8e49c85f48da5db1"],"severity":"High","spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["94654918781612247483811063862840027554","296468792354559022205288119916364429658","82871125724142472633236013785668441817","180514944661552183187273550678361925403"],"threshold":0.9},"id":"ASB-A-513648011-1575438c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/67ef036b9060552258b8caaf8e49c85f48da5db1","target":{"file":"libs/hwui/jni/Bitmap.cpp"}},{"deprecated":false,"digest":{"length":113,"function_hash":"36288759716345442900506949170843387867"},"id":"ASB-A-513648011-d954ffc9","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/67ef036b9060552258b8caaf8e49c85f48da5db1","target":{"function":"validateImageInfo","file":"libs/hwui/jni/Bitmap.cpp"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-513648011.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/58b07718174f5fd713ed5e2994a79294d8b5aa73","target":{"file":"libs/hwui/jni/Bitmap.cpp","function":"validateImageInfo"},"deprecated":false,"digest":{"function_hash":"36288759716345442900506949170843387867","length":113},"id":"ASB-A-513648011-1a8b5a79"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/58b07718174f5fd713ed5e2994a79294d8b5aa73","target":{"file":"libs/hwui/jni/Bitmap.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["94654918781612247483811063862840027554","296468792354559022205288119916364429658","199826806362808061630851351955576283753","149667207129454943059440100123040215073"]},"id":"ASB-A-513648011-63aa54a6","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/58b07718174f5fd713ed5e2994a79294d8b5aa73"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-513648011.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"types":["ID"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/05f0ef4e67e5284d737b500472535ec2d41c761b","target":{"file":"libs/hwui/jni/Bitmap.cpp"},"deprecated":false,"digest":{"line_hashes":["94654918781612247483811063862840027554","296468792354559022205288119916364429658","199826806362808061630851351955576283753","208297895565310584332630736759101993744"],"threshold":0.9},"id":"ASB-A-513648011-bf082045","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/05f0ef4e67e5284d737b500472535ec2d41c761b","target":{"function":"validateImageInfo","file":"libs/hwui/jni/Bitmap.cpp"},"deprecated":false,"digest":{"function_hash":"36288759716345442900506949170843387867","length":113},"id":"ASB-A-513648011-fe6d6a04","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/05f0ef4e67e5284d737b500472535ec2d41c761b"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-513648011.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/a9ed7116bfdc6934bf074d839a98130840c32067","target":{"file":"libs/hwui/jni/Bitmap.cpp"},"deprecated":false,"digest":{"line_hashes":["94654918781612247483811063862840027554","296468792354559022205288119916364429658","199826806362808061630851351955576283753","208297895565310584332630736759101993744"],"threshold":0.9},"id":"ASB-A-513648011-b6eca38a","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a9ed7116bfdc6934bf074d839a98130840c32067","target":{"function":"validateImageInfo","file":"libs/hwui/jni/Bitmap.cpp"},"deprecated":false,"digest":{"function_hash":"36288759716345442900506949170843387867","length":113},"id":"ASB-A-513648011-f6f6a9d0"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/a9ed7116bfdc6934bf074d839a98130840c32067"],"severity":"High","spl":"2026-11-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-513648011.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/27d853381628772829e1a4fa68ac6507431d6eb6","target":{"file":"libs/hwui/jni/Bitmap.cpp"},"deprecated":false,"digest":{"line_hashes":["94654918781612247483811063862840027554","296468792354559022205288119916364429658","199826806362808061630851351955576283753","208297895565310584332630736759101993744"],"threshold":0.9},"id":"ASB-A-513648011-74749f5a","signature_type":"Line","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/27d853381628772829e1a4fa68ac6507431d6eb6","target":{"function":"validateImageInfo","file":"libs/hwui/jni/Bitmap.cpp"},"deprecated":false,"digest":{"function_hash":"36288759716345442900506949170843387867","length":113},"id":"ASB-A-513648011-8ecc4442","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/27d853381628772829e1a4fa68ac6507431d6eb6"],"severity":"High","spl":"2026-11-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-513648011.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"vanir_signatures":[{"target":{"file":"libs/hwui/jni/Bitmap.cpp"},"deprecated":false,"digest":{"line_hashes":["94654918781612247483811063862840027554","296468792354559022205288119916364429658","199826806362808061630851351955576283753","149667207129454943059440100123040215073"],"threshold":0.9},"id":"ASB-A-513648011-195dc26f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/b7e3d69a5323ab48e1f7817aebea8f22ba345739"},{"target":{"file":"libs/hwui/jni/Bitmap.cpp","function":"validateImageInfo"},"deprecated":false,"digest":{"function_hash":"36288759716345442900506949170843387867","length":113},"id":"ASB-A-513648011-23d03919","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/b7e3d69a5323ab48e1f7817aebea8f22ba345739"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/b7e3d69a5323ab48e1f7817aebea8f22ba345739"],"severity":"High","spl":"2026-11-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-513648011.json"}}],"schema_version":"1.9.2"}