{"id":"ASB-A-514861143","details":"In handleAudioEffectBroadcast of MusicFxHelper.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-514861143","CVE-2026-58965"],"modified":"2026-11-02T16:56:13.533848094Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-514861143-5471aaae","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/345b72fc9723115f9e23333399b91d41072af870","target":{"file":"services/core/java/com/android/server/audio/MusicFxHelper.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["248382360405471960969166627074013647304","205004351597962891449145385827434924702","213010595239284306084692777455667424470","157535703544494628816552543822761572143","135915174644904446007112645605573380938","269652769217749816159660307977680570663","179012441900003429427001493973654201081","246217228973272024842025465015618779582","235913920461917483845449524279187455633","231724840023296193521032363761452406510","45115594848537085543042441585225828861","247507678464968653310678599205161482957","161634615215735113371748108435630708664","84347920145904163312157626758573139963","284597559233862126897010525198237215227","18768510257960205339053636300288432815"]}},{"digest":{"function_hash":"230621837033660777755161982981535206973","length":1191},"id":"ASB-A-514861143-965a3b93","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/345b72fc9723115f9e23333399b91d41072af870","target":{"function":"handleAudioEffectBroadcast","file":"services/core/java/com/android/server/audio/MusicFxHelper.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/345b72fc9723115f9e23333399b91d41072af870"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-514861143.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"digest":{"line_hashes":["248382360405471960969166627074013647304","205004351597962891449145385827434924702","213010595239284306084692777455667424470","157535703544494628816552543822761572143","231724840023296193521032363761452406510","45115594848537085543042441585225828861","247507678464968653310678599205161482957","161634615215735113371748108435630708664","84347920145904163312157626758573139963","284597559233862126897010525198237215227","18768510257960205339053636300288432815"],"threshold":0.9},"id":"ASB-A-514861143-4d698342","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/53d6c92fb95b95fec69acd56191dea20220d4484","target":{"file":"services/core/java/com/android/server/audio/MusicFxHelper.java"},"deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/base/+/53d6c92fb95b95fec69acd56191dea20220d4484","target":{"file":"services/core/java/com/android/server/audio/MusicFxHelper.java","function":"handleAudioEffectBroadcast"},"deprecated":false,"digest":{"function_hash":"230621837033660777755161982981535206973","length":1191},"id":"ASB-A-514861143-fb67b93a","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/53d6c92fb95b95fec69acd56191dea20220d4484"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-514861143.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/0ddeefc2f5978bc3fd2991e65c8cb5277ebc7505"],"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0ddeefc2f5978bc3fd2991e65c8cb5277ebc7505","target":{"file":"services/core/java/com/android/server/audio/MusicFxHelper.java"},"deprecated":false,"digest":{"line_hashes":["248382360405471960969166627074013647304","205004351597962891449145385827434924702","213010595239284306084692777455667424470","157535703544494628816552543822761572143","135915174644904446007112645605573380938","269652769217749816159660307977680570663","179012441900003429427001493973654201081","246217228973272024842025465015618779582","235913920461917483845449524279187455633","231724840023296193521032363761452406510","45115594848537085543042441585225828861","247507678464968653310678599205161482957","161634615215735113371748108435630708664","84347920145904163312157626758573139963","284597559233862126897010525198237215227","18768510257960205339053636300288432815"],"threshold":0.9},"id":"ASB-A-514861143-2c320777"},{"digest":{"function_hash":"230621837033660777755161982981535206973","length":1191},"id":"ASB-A-514861143-3ede4fac","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0ddeefc2f5978bc3fd2991e65c8cb5277ebc7505","target":{"function":"handleAudioEffectBroadcast","file":"services/core/java/com/android/server/audio/MusicFxHelper.java"},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-514861143.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1408f4fe6a6c5a4131357c5a87d70bf39940a996","target":{"file":"services/core/java/com/android/server/audio/MusicFxHelper.java"},"deprecated":false,"digest":{"line_hashes":["248382360405471960969166627074013647304","205004351597962891449145385827434924702","213010595239284306084692777455667424470","157535703544494628816552543822761572143","135915174644904446007112645605573380938","269652769217749816159660307977680570663","179012441900003429427001493973654201081","246217228973272024842025465015618779582","235913920461917483845449524279187455633","231724840023296193521032363761452406510","45115594848537085543042441585225828861","247507678464968653310678599205161482957","161634615215735113371748108435630708664","84347920145904163312157626758573139963","284597559233862126897010525198237215227","18768510257960205339053636300288432815"],"threshold":0.9},"id":"ASB-A-514861143-78a75da9","signature_type":"Line"},{"digest":{"function_hash":"230621837033660777755161982981535206973","length":1191},"id":"ASB-A-514861143-7cf1cae5","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1408f4fe6a6c5a4131357c5a87d70bf39940a996","target":{"file":"services/core/java/com/android/server/audio/MusicFxHelper.java","function":"handleAudioEffectBroadcast"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/1408f4fe6a6c5a4131357c5a87d70bf39940a996"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-514861143.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/100184d4815efe13055e649661ad486c9f25fbc0","target":{"file":"services/core/java/com/android/server/audio/MusicFxHelper.java","function":"handleAudioEffectBroadcast"},"deprecated":false,"digest":{"function_hash":"230621837033660777755161982981535206973","length":1191},"id":"ASB-A-514861143-41619fb7","signature_type":"Function","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/100184d4815efe13055e649661ad486c9f25fbc0","target":{"file":"services/core/java/com/android/server/audio/MusicFxHelper.java"},"deprecated":false,"digest":{"line_hashes":["248382360405471960969166627074013647304","205004351597962891449145385827434924702","213010595239284306084692777455667424470","157535703544494628816552543822761572143","135915174644904446007112645605573380938","269652769217749816159660307977680570663","179012441900003429427001493973654201081","246217228973272024842025465015618779582","235913920461917483845449524279187455633","231724840023296193521032363761452406510","45115594848537085543042441585225828861","247507678464968653310678599205161482957","161634615215735113371748108435630708664","84347920145904163312157626758573139963","284597559233862126897010525198237215227","18768510257960205339053636300288432815"],"threshold":0.9},"id":"ASB-A-514861143-f14884f9","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/100184d4815efe13055e649661ad486c9f25fbc0"],"severity":"High","spl":"2026-11-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-514861143.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"services/core/java/com/android/server/audio/AudioService.java"},"deprecated":false,"digest":{"line_hashes":["112620547493041188773723250249494952053","308604727651066345928064777861920848360","197989311462221102831558988771403710570","20322409222960852425852426981091475646","204387090683937794224093613292591538053","8887686756717290936610356737713652666","86429630284879377090487036464972354572","52125010352115330539900196961797005409","300428246870568721230719132986233756506","177404075630814265516196903143559839259","43277766059729399186460922060471900751","160025340106742524341670945130100192723"],"threshold":0.9},"id":"ASB-A-514861143-ac268a4b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/b860564359ec5c4cbf7fe3df55edfbc291d28aae"},{"deprecated":false,"digest":{"length":682,"function_hash":"332163809716956602176126933046126666356"},"id":"ASB-A-514861143-cbf8224b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/b860564359ec5c4cbf7fe3df55edfbc291d28aae","target":{"file":"services/core/java/com/android/server/audio/AudioService.java","function":"handleAudioEffectBroadcast"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/b860564359ec5c4cbf7fe3df55edfbc291d28aae"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-514861143.json"}}],"schema_version":"1.9.2"}