{"id":"ASB-A-515034370","details":"In multiple functions of VirtualAudioControllerTest.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-515034370","CVE-2026-58841"],"modified":"2026-10-05T16:41:13.118670718Z","published":"2026-10-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-10-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-10-01"}]}],"versions":["17-next"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/0f9980b2d1e9491c157999b4f9d8c7b57cca1836","target":{"function":"startListening","file":"services/companion/java/com/android/server/companion/virtual/audio/VirtualAudioController.java"},"deprecated":false,"digest":{"function_hash":"311493504422542974848364777683235904553","length":462},"id":"ASB-A-515034370-26858074","signature_type":"Function","signature_version":"v1"},{"id":"ASB-A-515034370-8bc1a68e","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0f9980b2d1e9491c157999b4f9d8c7b57cca1836","target":{"file":"services/companion/java/com/android/server/companion/virtual/audio/VirtualAudioController.java"},"deprecated":false,"digest":{"line_hashes":["219721717912212969716951418095952150887","307455912926683355529111201384698596895","211931005751815617225610792759912525823","38766678875630256600490896309354039955"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/0f9980b2d1e9491c157999b4f9d8c7b57cca1836","https://android.googlesource.com/platform/frameworks/base/+/ba81dfdd9be125a4435eaaf485ccf428d427faf2"],"severity":"High","spl":"2026-10-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-515034370.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-10-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/43c51e370480ac0404b71962514cb76682c5fb1d","target":{"function":"startListening","file":"services/companion/java/com/android/server/companion/virtual/audio/VirtualAudioController.java"},"deprecated":false,"digest":{"function_hash":"136496897715534897836828456591959241695","length":491},"id":"ASB-A-515034370-2a380500","signature_type":"Function"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/43c51e370480ac0404b71962514cb76682c5fb1d","target":{"file":"services/companion/java/com/android/server/companion/virtual/audio/VirtualAudioController.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["92020129646517693899927115448283808998","289966074674036858919263706542795282444","295664288773163144789901559466986365779","336976802257631480626205337165908970056","65669552442249448918670412524020289347","127167438438468570105989388517809464902"]},"id":"ASB-A-515034370-5a5302f8","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/43c51e370480ac0404b71962514cb76682c5fb1d"],"severity":"High","spl":"2026-10-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-515034370.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-10-01"}]}],"versions":["16"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"id":"ASB-A-515034370-60d9748d","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/624d1375d2e54f396cab607b3e65ef88f822dce3","target":{"file":"services/companion/java/com/android/server/companion/virtual/audio/VirtualAudioController.java"},"deprecated":false,"digest":{"line_hashes":["92020129646517693899927115448283808998","289966074674036858919263706542795282444","295664288773163144789901559466986365779","336976802257631480626205337165908970056","65669552442249448918670412524020289347","127167438438468570105989388517809464902"],"threshold":0.9}},{"id":"ASB-A-515034370-c57aa834","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/624d1375d2e54f396cab607b3e65ef88f822dce3","target":{"function":"startListening","file":"services/companion/java/com/android/server/companion/virtual/audio/VirtualAudioController.java"},"deprecated":false,"digest":{"function_hash":"136496897715534897836828456591959241695","length":491}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/624d1375d2e54f396cab607b3e65ef88f822dce3"],"severity":"High","spl":"2026-10-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-515034370.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-10-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"id":"ASB-A-515034370-5d6a9883","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a003139e2da845cf8a6664b95035a2221ceaea66","target":{"file":"services/companion/java/com/android/server/companion/virtual/audio/VirtualAudioController.java","function":"startListening"},"deprecated":false,"digest":{"length":487,"function_hash":"322089654513965057324180713775126989972"}},{"deprecated":false,"digest":{"line_hashes":["44936071166917269949661109090755413320","289966074674036858919263706542795282444","295664288773163144789901559466986365779","336976802257631480626205337165908970056","65669552442249448918670412524020289347","127167438438468570105989388517809464902"],"threshold":0.9},"id":"ASB-A-515034370-c53af07f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a003139e2da845cf8a6664b95035a2221ceaea66","target":{"file":"services/companion/java/com/android/server/companion/virtual/audio/VirtualAudioController.java"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/a003139e2da845cf8a6664b95035a2221ceaea66"],"severity":"High","spl":"2026-10-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-515034370.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-10-01"}]}],"versions":["17"],"ecosystem_specific":{"spl":"2026-10-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-515034370-29683f6b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/26bbdd921d94ef850727a699e87e702fdadeac61","target":{"file":"services/companion/java/com/android/server/companion/virtual/audio/VirtualAudioController.java"},"deprecated":false,"digest":{"line_hashes":["44936071166917269949661109090755413320","289966074674036858919263706542795282444","295664288773163144789901559466986365779","336976802257631480626205337165908970056","65669552442249448918670412524020289347","127167438438468570105989388517809464902"],"threshold":0.9}},{"deprecated":false,"digest":{"length":487,"function_hash":"322089654513965057324180713775126989972"},"id":"ASB-A-515034370-76cd4c35","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/26bbdd921d94ef850727a699e87e702fdadeac61","target":{"file":"services/companion/java/com/android/server/companion/virtual/audio/VirtualAudioController.java","function":"startListening"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/26bbdd921d94ef850727a699e87e702fdadeac61"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-515034370.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-10-01"}]}],"versions":["14"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"136496897715534897836828456591959241695","length":491},"id":"ASB-A-515034370-6b28896b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/14fc994e4647d7f96381713be1134583aa862213","target":{"file":"services/companion/java/com/android/server/companion/virtual/audio/VirtualAudioController.java","function":"startListening"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/14fc994e4647d7f96381713be1134583aa862213","target":{"file":"services/companion/java/com/android/server/companion/virtual/audio/VirtualAudioController.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["92020129646517693899927115448283808998","289966074674036858919263706542795282444","295664288773163144789901559466986365779","336976802257631480626205337165908970056","65669552442249448918670412524020289347","127167438438468570105989388517809464902"]},"id":"ASB-A-515034370-87c7b3f8","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/14fc994e4647d7f96381713be1134583aa862213"],"severity":"High","spl":"2026-10-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-515034370.json"}}],"schema_version":"1.9.0"}