{"id":"ASB-A-514738573","details":"In multiple functions of MediaQualityService.java, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-514738573","CVE-2026-58969"],"modified":"2026-11-02T17:11:21.206384768Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"deprecated":false,"digest":{"length":414,"function_hash":"75968111871350797374716117111218099496"},"id":"ASB-A-514738573-1819fb96","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a3b80f7ce7a3c0705ce23ef0a78da55ad8bc75e8","target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java","function":"getSoundProfileHandle"}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a3b80f7ce7a3c0705ce23ef0a78da55ad8bc75e8","target":{"function":"changeStreamStatus","file":"services/core/java/com/android/server/media/quality/MediaQualityService.java"},"deprecated":false,"digest":{"function_hash":"44731740757539782425255364890924601592","length":393},"id":"ASB-A-514738573-21976c8c"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/a3b80f7ce7a3c0705ce23ef0a78da55ad8bc75e8","target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java","function":"getSoundProfileHandles"},"deprecated":false,"digest":{"function_hash":"136695167180809707680414990734137890726","length":425},"id":"ASB-A-514738573-2f798423","signature_type":"Function","signature_version":"v1"},{"match_only_versions":["17-qpr2-next"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a3b80f7ce7a3c0705ce23ef0a78da55ad8bc75e8","target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java","function":"getPictureProfileHandles"},"deprecated":false,"digest":{"function_hash":"127210912652326037058959950996971216895","length":324},"id":"ASB-A-514738573-b7d837a4"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a3b80f7ce7a3c0705ce23ef0a78da55ad8bc75e8","target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java","function":"getCurrentPictureProfileForTvInput"},"deprecated":false,"digest":{"function_hash":"316689722955556252890316772557286074536","length":673},"id":"ASB-A-514738573-bbb41b01"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a3b80f7ce7a3c0705ce23ef0a78da55ad8bc75e8","target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java"},"deprecated":false,"digest":{"line_hashes":["63935159647491669776230661416050959825","5878535113246630305281161218049081822","21425213185398705961190530962029078501","34469644831765651521079379138660887103","284314181773111065847840835898098043849","249462752842489073780578338238790828024","30413569907577416364077373046660802291","338256918416844609031725071551827170186","265567590743227180389380985871846166535","60883053853459115247759513156203237519","16246521312307932878942424096531657306","20168779053797833778431958605093379659","131316974097212363915449424048239112030","62201951904462080585796953879468546277","310621453790425017512432711202820360511","270933647974050237240111042913043093674","93208182594457378131224371222949398590","137763330799131906466724952264048137761","164653503605269560695990518836817907653","270933647974050237240111042913043093674","119303218944700277638726319857663987837","213321798444587238424359389302403865282","15608955200517133088604937741333764155","187005337770961473672258370848779357328","198299295782471091565525168679217228636","64988218193163757768306990437425992526","261558917276930009700073559986729430641","324593661457766231370501030839807546128","7698378015680125423484765419355849974","14278630882923785029304331787646562435","106277359409810563078782569168658195624","324593661457766231370501030839807546128"],"threshold":0.9},"id":"ASB-A-514738573-d515a2bd"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/a3b80f7ce7a3c0705ce23ef0a78da55ad8bc75e8","target":{"function":"getCurrentPictureProfileHandleForTvInput","file":"services/core/java/com/android/server/media/quality/MediaQualityService.java"},"deprecated":false,"digest":{"length":1807,"function_hash":"186890170542716355642869497804687089639"},"id":"ASB-A-514738573-dcb49fde","signature_type":"Function","signature_version":"v1"},{"id":"ASB-A-514738573-eb92b412","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a3b80f7ce7a3c0705ce23ef0a78da55ad8bc75e8","target":{"function":"getPictureProfileForTvInput","file":"services/core/java/com/android/server/media/quality/MediaQualityService.java"},"deprecated":false,"digest":{"function_hash":"7951483112429740001219292215476769158","length":1755}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a3b80f7ce7a3c0705ce23ef0a78da55ad8bc75e8","target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java","function":"getPictureProfileHandle"},"deprecated":false,"digest":{"function_hash":"127210912652326037058959950996971216895","length":324},"id":"ASB-A-514738573-f24ae720","match_only_versions":["17-qpr2-next"],"signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/a3b80f7ce7a3c0705ce23ef0a78da55ad8bc75e8"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-514738573.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7ea2fce0280537a4b106152b826b7a5d9aac6fbb","target":{"function":"getPictureProfileHandle","file":"services/core/java/com/android/server/media/quality/MediaQualityService.java"},"deprecated":false,"digest":{"length":324,"function_hash":"127210912652326037058959950996971216895"},"id":"ASB-A-514738573-0969143c","match_only_versions":["16-qpr2"]},{"id":"ASB-A-514738573-0a4b153b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7ea2fce0280537a4b106152b826b7a5d9aac6fbb","target":{"function":"changeStreamStatus","file":"services/core/java/com/android/server/media/quality/MediaQualityService.java"},"deprecated":false,"digest":{"function_hash":"44731740757539782425255364890924601592","length":393}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/7ea2fce0280537a4b106152b826b7a5d9aac6fbb","target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java","function":"getPictureProfileForTvInput"},"deprecated":false,"digest":{"function_hash":"36805075702919605960977202180401542857","length":1444},"id":"ASB-A-514738573-643b6d58","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"51523341188395055412367712679519781531","length":300},"id":"ASB-A-514738573-b541157b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7ea2fce0280537a4b106152b826b7a5d9aac6fbb","target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java","function":"getCurrentPictureProfileForTvInput"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7ea2fce0280537a4b106152b826b7a5d9aac6fbb","target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java"},"deprecated":false,"digest":{"line_hashes":["63935159647491669776230661416050959825","5878535113246630305281161218049081822","21425213185398705961190530962029078501","34469644831765651521079379138660887103","284314181773111065847840835898098043849","249462752842489073780578338238790828024","30413569907577416364077373046660802291","338256918416844609031725071551827170186","131316974097212363915449424048239112030","62201951904462080585796953879468546277","310621453790425017512432711202820360511","270933647974050237240111042913043093674","119303218944700277638726319857663987837","213321798444587238424359389302403865282","15608955200517133088604937741333764155","187005337770961473672258370848779357328","198299295782471091565525168679217228636","64988218193163757768306990437425992526","261558917276930009700073559986729430641","324593661457766231370501030839807546128"],"threshold":0.9},"id":"ASB-A-514738573-df24a3a3","signature_type":"Line"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/7ea2fce0280537a4b106152b826b7a5d9aac6fbb","target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java","function":"getSoundProfileHandle"},"deprecated":false,"digest":{"function_hash":"75968111871350797374716117111218099496","length":414},"id":"ASB-A-514738573-e44c914d","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/7ea2fce0280537a4b106152b826b7a5d9aac6fbb"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-514738573.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"types":["ID"],"vanir_signatures":[{"target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java"},"deprecated":false,"digest":{"line_hashes":["63935159647491669776230661416050959825","5878535113246630305281161218049081822","21425213185398705961190530962029078501","34469644831765651521079379138660887103","284314181773111065847840835898098043849","249462752842489073780578338238790828024","30413569907577416364077373046660802291","338256918416844609031725071551827170186","265567590743227180389380985871846166535","60883053853459115247759513156203237519","16246521312307932878942424096531657306","20168779053797833778431958605093379659","131316974097212363915449424048239112030","62201951904462080585796953879468546277","310621453790425017512432711202820360511","270933647974050237240111042913043093674","93208182594457378131224371222949398590","137763330799131906466724952264048137761","164653503605269560695990518836817907653","270933647974050237240111042913043093674","119303218944700277638726319857663987837","213321798444587238424359389302403865282","15608955200517133088604937741333764155","187005337770961473672258370848779357328","198299295782471091565525168679217228636","64988218193163757768306990437425992526","261558917276930009700073559986729430641","324593661457766231370501030839807546128","7698378015680125423484765419355849974","14278630882923785029304331787646562435","106277359409810563078782569168658195624","324593661457766231370501030839807546128"],"threshold":0.9},"id":"ASB-A-514738573-40fdae44","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1c17b529207936a1b41d5cece5772cd2f4db0245"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1c17b529207936a1b41d5cece5772cd2f4db0245","target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java","function":"getPictureProfileForTvInput"},"deprecated":false,"digest":{"function_hash":"259824757067735663336560075825205012266","length":1639},"id":"ASB-A-514738573-61c2f5e2","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"75968111871350797374716117111218099496","length":414},"id":"ASB-A-514738573-71a46ed7","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1c17b529207936a1b41d5cece5772cd2f4db0245","target":{"function":"getSoundProfileHandle","file":"services/core/java/com/android/server/media/quality/MediaQualityService.java"}},{"deprecated":false,"digest":{"length":425,"function_hash":"136695167180809707680414990734137890726"},"id":"ASB-A-514738573-812bb07f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1c17b529207936a1b41d5cece5772cd2f4db0245","target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java","function":"getSoundProfileHandles"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/1c17b529207936a1b41d5cece5772cd2f4db0245","target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java","function":"changeStreamStatus"},"deprecated":false,"digest":{"length":393,"function_hash":"44731740757539782425255364890924601592"},"id":"ASB-A-514738573-96fa4c61","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1c17b529207936a1b41d5cece5772cd2f4db0245","target":{"function":"getPictureProfileHandles","file":"services/core/java/com/android/server/media/quality/MediaQualityService.java"},"deprecated":false,"digest":{"function_hash":"127210912652326037058959950996971216895","length":324},"id":"ASB-A-514738573-9d7b84ec","match_only_versions":["17"],"signature_type":"Function"},{"deprecated":false,"digest":{"length":324,"function_hash":"127210912652326037058959950996971216895"},"id":"ASB-A-514738573-b1f41d68","match_only_versions":["17"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1c17b529207936a1b41d5cece5772cd2f4db0245","target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java","function":"getPictureProfileHandle"}},{"id":"ASB-A-514738573-c00e953d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1c17b529207936a1b41d5cece5772cd2f4db0245","target":{"function":"getCurrentPictureProfileHandleForTvInput","file":"services/core/java/com/android/server/media/quality/MediaQualityService.java"},"deprecated":false,"digest":{"length":1676,"function_hash":"180099949139155384184675044415969821664"}},{"digest":{"length":300,"function_hash":"51523341188395055412367712679519781531"},"id":"ASB-A-514738573-e7fe71a9","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1c17b529207936a1b41d5cece5772cd2f4db0245","target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java","function":"getCurrentPictureProfileForTvInput"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/1c17b529207936a1b41d5cece5772cd2f4db0245"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-514738573.json"}}],"schema_version":"1.9.2"}