{"id":"ASB-A-514861024","details":"In multiple functions of MessageQueueBase.h, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-514861024","CVE-2026-49937"],"modified":"2026-10-05T16:41:13.403643427Z","published":"2026-10-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-10-01"}],"affected":[{"package":{"name":"platform/system/libfmq","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-10-01"}]}],"versions":["17-next"],"ecosystem_specific":{"types":["ID"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/system/libfmq/+/c4412ddafd204b5acbf2fbbdafe3ce694bc0a364","target":{"file":"tests/msgq_test_client.cpp"},"deprecated":false,"digest":{"line_hashes":["76206041526892211962646396845472950021","191907528547176398878570017263759147866","32531547688005130789249358872211243324","118169809678537940249736560515862445813","68822940984096068597527581011535437451","9555991473144796255311608425495533017","60049057751997589590320245186725948066","251556598417090489985932279558640173387","120984670660931273951859659480743918781","61388105964995959819153637772251961266","115503196078699863709844467656199545948"],"threshold":0.9},"id":"ASB-A-514861024-04cdd82c","match_only_versions":["17-next"],"signature_type":"Line","signature_version":"v1"},{"target":{"file":"include/fmq/MessageQueueBase.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["45867215650520688777788023400164125596","140133464956813212667640632040045683136","270644677685351241147787344024237775428","305418672955264418933735273582641511343","25834229121459270055445882568464104031","69934951959070445512155718714614681533","224678711229732403720595416488040702023","235032928215245813665202753175510967638","62982596592540177813972081673949407608","245763996035722372298532106121204853576","116849330672720531274231227524568962138","101929453765516955171117321362850686385","74390736163807888829628728104799016777","118801887538252480555983151005960889197","228260174008800986097582454956428034809","152546019295191193675496017617108237698","92357591836820672827276442257004540190","132563578786840273871339470800988818048","211388129820078743066876071758245879606"]},"id":"ASB-A-514861024-0bd47236","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/libfmq/+/c4412ddafd204b5acbf2fbbdafe3ce694bc0a364"},{"digest":{"function_hash":"139911085098309030906339346490630516306","length":1246},"id":"ASB-A-514861024-283255ee","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/libfmq/+/c4412ddafd204b5acbf2fbbdafe3ce694bc0a364","target":{"function":"beginRead","file":"include/fmq/MessageQueueBase.h"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"123939678422657434405001169811322595003","length":1227},"id":"ASB-A-514861024-2df46c6d","match_only_versions":["17-next"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/libfmq/+/c4412ddafd204b5acbf2fbbdafe3ce694bc0a364","target":{"file":"tests/msgq_test_client.cpp","function":"TYPED_TEST"}},{"source":"https://android.googlesource.com/platform/system/libfmq/+/c4412ddafd204b5acbf2fbbdafe3ce694bc0a364","target":{"file":"include/fmq/MessageQueueBase.h","function":"availableToReadBytes"},"deprecated":false,"digest":{"function_hash":"301300884765238787500469677348231182317","length":547},"id":"ASB-A-514861024-cf44903b","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/system/libfmq/+/c4412ddafd204b5acbf2fbbdafe3ce694bc0a364"],"severity":"High","spl":"2026-10-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-514861024.json"}},{"package":{"name":"platform/system/libfmq","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-10-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["ID"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/system/libfmq/+/1c74c042be1ef04a80c6387e0ffd1069cb9fcfad","target":{"function":"beginRead","file":"include/fmq/MessageQueueBase.h"},"deprecated":false,"digest":{"length":1088,"function_hash":"69729402645744846437019567190237861174"},"id":"ASB-A-514861024-8e1e9e97","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/libfmq/+/1c74c042be1ef04a80c6387e0ffd1069cb9fcfad","target":{"file":"include/fmq/MessageQueueBase.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["45815788745352691128219145941103992219","140133464956813212667640632040045683136","270644677685351241147787344024237775428","305418672955264418933735273582641511343","25834229121459270055445882568464104031","69934951959070445512155718714614681533","85216015122803612932386534835877634417","279917927168249908132223467729599692894","101929453765516955171117321362850686385","74390736163807888829628728104799016777","118801887538252480555983151005960889197","228260174008800986097582454956428034809","152546019295191193675496017617108237698","92357591836820672827276442257004540190","132563578786840273871339470800988818048","211388129820078743066876071758245879606"]},"id":"ASB-A-514861024-a7b86824","signature_type":"Line"},{"digest":{"length":620,"function_hash":"131637233386850605503462537491971777005"},"id":"ASB-A-514861024-c008ef99","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/libfmq/+/1c74c042be1ef04a80c6387e0ffd1069cb9fcfad","target":{"function":"availableToReadBytes","file":"include/fmq/MessageQueueBase.h"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/system/libfmq/+/1c74c042be1ef04a80c6387e0ffd1069cb9fcfad"],"severity":"High","spl":"2026-10-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-514861024.json"}},{"package":{"name":"platform/system/libfmq","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-10-01"}]}],"versions":["16"],"ecosystem_specific":{"types":["ID"],"vanir_signatures":[{"digest":{"function_hash":"287949070367596628806325081634248255873","length":1020},"id":"ASB-A-514861024-6a38a600","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/libfmq/+/0a35fb4c564387082635018cb6c9aca2659ead94","target":{"function":"beginRead","file":"include/fmq/MessageQueueBase.h"},"deprecated":false},{"source":"https://android.googlesource.com/platform/system/libfmq/+/0a35fb4c564387082635018cb6c9aca2659ead94","target":{"file":"include/fmq/MessageQueueBase.h","function":"availableToReadBytes"},"deprecated":false,"digest":{"length":547,"function_hash":"301300884765238787500469677348231182317"},"id":"ASB-A-514861024-76b10134","signature_type":"Function","signature_version":"v1"},{"target":{"file":"include/fmq/MessageQueueBase.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["45867215650520688777788023400164125596","140133464956813212667640632040045683136","270644677685351241147787344024237775428","305418672955264418933735273582641511343","25834229121459270055445882568464104031","69934951959070445512155718714614681533","224678711229732403720595416488040702023","235032928215245813665202753175510967638","62982596592540177813972081673949407608","245763996035722372298532106121204853576","116849330672720531274231227524568962138","101929453765516955171117321362850686385","74390736163807888829628728104799016777","118801887538252480555983151005960889197","228260174008800986097582454956428034809","152546019295191193675496017617108237698","92357591836820672827276442257004540190","132563578786840273871339470800988818048","211388129820078743066876071758245879606"]},"id":"ASB-A-514861024-e38cd32d","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/libfmq/+/0a35fb4c564387082635018cb6c9aca2659ead94"}],"fixes":["https://android.googlesource.com/platform/system/libfmq/+/0a35fb4c564387082635018cb6c9aca2659ead94"],"severity":"High","spl":"2026-10-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-514861024.json"}},{"package":{"name":"platform/system/libfmq","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-10-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"severity":"High","spl":"2026-10-01","types":["ID"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/libfmq/+/1e57a1c7890543dba24d8a4476225979e0568ab1","target":{"file":"include/fmq/MessageQueueBase.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["45867215650520688777788023400164125596","140133464956813212667640632040045683136","270644677685351241147787344024237775428","305418672955264418933735273582641511343","25834229121459270055445882568464104031","69934951959070445512155718714614681533","224678711229732403720595416488040702023","235032928215245813665202753175510967638","62982596592540177813972081673949407608","245763996035722372298532106121204853576","116849330672720531274231227524568962138","101929453765516955171117321362850686385","74390736163807888829628728104799016777","118801887538252480555983151005960889197","228260174008800986097582454956428034809","152546019295191193675496017617108237698","92357591836820672827276442257004540190","132563578786840273871339470800988818048","211388129820078743066876071758245879606"]},"id":"ASB-A-514861024-3e4027a6"},{"deprecated":false,"digest":{"function_hash":"12952492091312389243018081015368007061","length":1143},"id":"ASB-A-514861024-43fb9cc0","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/libfmq/+/1e57a1c7890543dba24d8a4476225979e0568ab1","target":{"file":"include/fmq/MessageQueueBase.h","function":"beginRead"}},{"digest":{"length":547,"function_hash":"301300884765238787500469677348231182317"},"id":"ASB-A-514861024-6c022b06","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/libfmq/+/1e57a1c7890543dba24d8a4476225979e0568ab1","target":{"function":"availableToReadBytes","file":"include/fmq/MessageQueueBase.h"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/system/libfmq/+/1e57a1c7890543dba24d8a4476225979e0568ab1"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-514861024.json"}},{"package":{"name":"platform/system/libfmq","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-10-01"}]}],"versions":["17"],"ecosystem_specific":{"types":["ID"],"vanir_signatures":[{"digest":{"line_hashes":["45867215650520688777788023400164125596","140133464956813212667640632040045683136","270644677685351241147787344024237775428","305418672955264418933735273582641511343","25834229121459270055445882568464104031","69934951959070445512155718714614681533","224678711229732403720595416488040702023","235032928215245813665202753175510967638","62982596592540177813972081673949407608","245763996035722372298532106121204853576","116849330672720531274231227524568962138","101929453765516955171117321362850686385","74390736163807888829628728104799016777","118801887538252480555983151005960889197","228260174008800986097582454956428034809","152546019295191193675496017617108237698","92357591836820672827276442257004540190","132563578786840273871339470800988818048","211388129820078743066876071758245879606"],"threshold":0.9},"id":"ASB-A-514861024-21058cae","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/system/libfmq/+/92cf2be8cb402c8c324eed46d20bddc4bee6bb58","target":{"file":"include/fmq/MessageQueueBase.h"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/libfmq/+/92cf2be8cb402c8c324eed46d20bddc4bee6bb58","target":{"file":"include/fmq/MessageQueueBase.h","function":"availableToReadBytes"},"deprecated":false,"digest":{"length":547,"function_hash":"301300884765238787500469677348231182317"},"id":"ASB-A-514861024-65ce5229"},{"id":"ASB-A-514861024-99fec029","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/libfmq/+/92cf2be8cb402c8c324eed46d20bddc4bee6bb58","target":{"file":"include/fmq/MessageQueueBase.h","function":"beginRead"},"deprecated":false,"digest":{"length":1246,"function_hash":"139911085098309030906339346490630516306"}}],"fixes":["https://android.googlesource.com/platform/system/libfmq/+/92cf2be8cb402c8c324eed46d20bddc4bee6bb58"],"severity":"High","spl":"2026-10-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-514861024.json"}},{"package":{"name":"platform/system/libfmq","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-10-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","spl":"2026-10-01","types":["ID"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/system/libfmq/+/7e9c2e78af85bfe39bd33bf5f95dd65a62be3392","target":{"function":"beginRead","file":"include/fmq/MessageQueueBase.h"},"deprecated":false,"digest":{"length":1088,"function_hash":"76824368080490118361616513206811986012"},"id":"ASB-A-514861024-0cf1d729"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/system/libfmq/+/7e9c2e78af85bfe39bd33bf5f95dd65a62be3392","target":{"file":"include/fmq/MessageQueueBase.h"},"deprecated":false,"digest":{"line_hashes":["236790446554061048025514260668192785994","145374696072744784137128413298272023714","157559149598288620879374759851558678482","247644322104168295171153532836549454340","31762282903101419616984183156013777100","315050152128380115997968616444699884437","336358305495026340785883668739171057697","74390736163807888829628728104799016777","118801887538252480555983151005960889197","228260174008800986097582454956428034809","152546019295191193675496017617108237698","92357591836820672827276442257004540190","132563578786840273871339470800988818048","211388129820078743066876071758245879606"],"threshold":0.9},"id":"ASB-A-514861024-36475657","signature_type":"Line"},{"source":"https://android.googlesource.com/platform/system/libfmq/+/7e9c2e78af85bfe39bd33bf5f95dd65a62be3392","target":{"file":"include/fmq/MessageQueueBase.h","function":"availableToReadBytes"},"deprecated":false,"digest":{"function_hash":"95745458625735590135592403573869272846","length":353},"id":"ASB-A-514861024-ca0af4e1","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/system/libfmq/+/7e9c2e78af85bfe39bd33bf5f95dd65a62be3392"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-514861024.json"}}],"schema_version":"1.9.0"}