{"id":"ASB-A-515038894","details":"In multiple locations, there is a possible denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-515038894","CVE-2026-58875"],"modified":"2026-11-02T17:11:21.391272753Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"spl":"2026-11-01","types":["DoS"],"vanir_signatures":[{"exact_target_file_match_only":true,"id":"ASB-A-515038894-31054870","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/4439c37ea4d31b1cfdd99d2f7b90efe000019fb5","target":{"function":"writeBundle","file":"services/devicepolicy/java/com/android/server/devicepolicy/BundlePolicySerializer.java"},"deprecated":false,"digest":{"function_hash":"335455891683046016734286597225358668526","length":1670}},{"target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/BundlePolicySerializer.java"},"deprecated":false,"digest":{"line_hashes":["162650519800005454501044961921539234740","204987794194783212035451606112588096894","158218492816319073545052545840941953302","253509162939209170374914067461442000582","37997544194398040395011945097086673139","7895669008674567970537792357723895015","175579121158468716987440761551257615414","146313485012384398407829236266616846378","60172917206724522744580435407831004335","30378688722491261743343452195783639086","135256857446213728468876247704345105472","128337708091765832135411580191428884993","186118732364553440545191216726505730065"],"threshold":0.9},"exact_target_file_match_only":true,"id":"ASB-A-515038894-894d36c2","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/4439c37ea4d31b1cfdd99d2f7b90efe000019fb5"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/4439c37ea4d31b1cfdd99d2f7b90efe000019fb5","target":{"file":"core/java/android/app/admin/BundlePolicyValue.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["326702412561026300024393815901295686604","156472992673584159090915524232794286114","334149357670228648920450111726280653985","313631074303561151230177818364313802212"]},"id":"ASB-A-515038894-8a16bbeb"},{"target":{"file":"core/java/android/app/admin/BundlePolicyValue.java","function":"BundlePolicyValue"},"deprecated":false,"digest":{"function_hash":"151382637282007823010701210116897683337","length":88},"id":"ASB-A-515038894-9bb4e780","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/4439c37ea4d31b1cfdd99d2f7b90efe000019fb5"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/4439c37ea4d31b1cfdd99d2f7b90efe000019fb5"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-515038894.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/3b224c4cc4936ddbe6a67788876fd5ac3dcbcd58"],"severity":"High","spl":"2026-11-01","types":["DoS"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/3b224c4cc4936ddbe6a67788876fd5ac3dcbcd58","target":{"file":"core/java/android/app/admin/BundlePolicyValue.java"},"deprecated":false,"digest":{"line_hashes":["7540256208188569581567591137097669405","297774780391349797203350345284766764073","258132645464798362332910337890688245894","56970640530097525276345500447958491870"],"threshold":0.9},"id":"ASB-A-515038894-4b7fc81c"},{"deprecated":false,"digest":{"length":1670,"function_hash":"335455891683046016734286597225358668526"},"exact_target_file_match_only":true,"id":"ASB-A-515038894-62d06e64","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/3b224c4cc4936ddbe6a67788876fd5ac3dcbcd58","target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/BundlePolicySerializer.java","function":"writeBundle"}},{"digest":{"function_hash":"233904148531596839480881800503722808465","length":120},"id":"ASB-A-515038894-ac843bf5","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/3b224c4cc4936ddbe6a67788876fd5ac3dcbcd58","target":{"function":"BundlePolicyValue","file":"core/java/android/app/admin/BundlePolicyValue.java"},"deprecated":false},{"exact_target_file_match_only":true,"id":"ASB-A-515038894-f675e21b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/3b224c4cc4936ddbe6a67788876fd5ac3dcbcd58","target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/BundlePolicySerializer.java"},"deprecated":false,"digest":{"line_hashes":["162650519800005454501044961921539234740","204987794194783212035451606112588096894","158218492816319073545052545840941953302","253509162939209170374914067461442000582","37997544194398040395011945097086673139","7895669008674567970537792357723895015","175579121158468716987440761551257615414","146313485012384398407829236266616846378","60172917206724522744580435407831004335","30378688722491261743343452195783639086","135256857446213728468876247704345105472","128337708091765832135411580191428884993","186118732364553440545191216726505730065"],"threshold":0.9}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-515038894.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/c46686151da28380cb7eed6938cd6f9467e9afe4"],"severity":"High","spl":"2026-11-01","types":["DoS"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c46686151da28380cb7eed6938cd6f9467e9afe4","target":{"function":"writeBundle","file":"services/devicepolicy/java/com/android/server/devicepolicy/BundlePolicySerializer.java"},"deprecated":false,"digest":{"length":1670,"function_hash":"335455891683046016734286597225358668526"},"exact_target_file_match_only":true,"id":"ASB-A-515038894-17afed00"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/c46686151da28380cb7eed6938cd6f9467e9afe4","target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/BundlePolicySerializer.java"},"deprecated":false,"digest":{"line_hashes":["162650519800005454501044961921539234740","204987794194783212035451606112588096894","158218492816319073545052545840941953302","253509162939209170374914067461442000582","37997544194398040395011945097086673139","7895669008674567970537792357723895015","175579121158468716987440761551257615414","146313485012384398407829236266616846378","60172917206724522744580435407831004335","30378688722491261743343452195783639086","135256857446213728468876247704345105472","128337708091765832135411580191428884993","186118732364553440545191216726505730065"],"threshold":0.9},"exact_target_file_match_only":true,"id":"ASB-A-515038894-2433f008","signature_type":"Line","signature_version":"v1"},{"target":{"file":"core/java/android/app/admin/BundlePolicyValue.java"},"deprecated":false,"digest":{"line_hashes":["7540256208188569581567591137097669405","178219666398875587161627291125987802221","334149357670228648920450111726280653985","313631074303561151230177818364313802212"],"threshold":0.9},"id":"ASB-A-515038894-b0273b63","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c46686151da28380cb7eed6938cd6f9467e9afe4"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/c46686151da28380cb7eed6938cd6f9467e9afe4","target":{"file":"core/java/android/app/admin/BundlePolicyValue.java","function":"BundlePolicyValue"},"deprecated":false,"digest":{"function_hash":"151382637282007823010701210116897683337","length":88},"id":"ASB-A-515038894-ba531c74","signature_type":"Function","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-515038894.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"spl":"2026-11-01","types":["DoS"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/3809dd9cc37820872f852b0afd07706076d77ed2","target":{"file":"core/java/android/app/admin/BundlePolicyValue.java","function":"BundlePolicyValue"},"deprecated":false,"digest":{"function_hash":"151382637282007823010701210116897683337","length":88},"id":"ASB-A-515038894-0e86482a","signature_type":"Function"},{"digest":{"line_hashes":["162650519800005454501044961921539234740","204987794194783212035451606112588096894","158218492816319073545052545840941953302","253509162939209170374914067461442000582","37997544194398040395011945097086673139","7895669008674567970537792357723895015","175579121158468716987440761551257615414","146313485012384398407829236266616846378","60172917206724522744580435407831004335","30378688722491261743343452195783639086","135256857446213728468876247704345105472","128337708091765832135411580191428884993","186118732364553440545191216726505730065"],"threshold":0.9},"exact_target_file_match_only":true,"id":"ASB-A-515038894-2bfa0fd9","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/3809dd9cc37820872f852b0afd07706076d77ed2","target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/BundlePolicySerializer.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"335455891683046016734286597225358668526","length":1670},"exact_target_file_match_only":true,"id":"ASB-A-515038894-98ce1a18","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/3809dd9cc37820872f852b0afd07706076d77ed2","target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/BundlePolicySerializer.java","function":"writeBundle"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/3809dd9cc37820872f852b0afd07706076d77ed2","target":{"file":"core/java/android/app/admin/BundlePolicyValue.java"},"deprecated":false,"digest":{"line_hashes":["7540256208188569581567591137097669405","178219666398875587161627291125987802221","334149357670228648920450111726280653985","313631074303561151230177818364313802212"],"threshold":0.9},"id":"ASB-A-515038894-ee7ce868","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/3809dd9cc37820872f852b0afd07706076d77ed2"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-515038894.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"types":["DoS"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f840119d646c05edb7880c9f1276f92aa1c4736b","target":{"function":"writeBundle","file":"services/devicepolicy/java/com/android/server/devicepolicy/BundlePolicySerializer.java"},"deprecated":false,"digest":{"length":1670,"function_hash":"335455891683046016734286597225358668526"},"exact_target_file_match_only":true,"id":"ASB-A-515038894-84071e26","signature_type":"Function"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/f840119d646c05edb7880c9f1276f92aa1c4736b","target":{"file":"core/java/android/app/admin/BundlePolicyValue.java","function":"BundlePolicyValue"},"deprecated":false,"digest":{"function_hash":"151382637282007823010701210116897683337","length":88},"id":"ASB-A-515038894-a19ba712","signature_type":"Function","signature_version":"v1"},{"id":"ASB-A-515038894-b351f5a4","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f840119d646c05edb7880c9f1276f92aa1c4736b","target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/BundlePolicySerializer.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["162650519800005454501044961921539234740","204987794194783212035451606112588096894","158218492816319073545052545840941953302","253509162939209170374914067461442000582","37997544194398040395011945097086673139","7895669008674567970537792357723895015","175579121158468716987440761551257615414","146313485012384398407829236266616846378","60172917206724522744580435407831004335","30378688722491261743343452195783639086","135256857446213728468876247704345105472","128337708091765832135411580191428884993","186118732364553440545191216726505730065"]},"exact_target_file_match_only":true},{"source":"https://android.googlesource.com/platform/frameworks/base/+/f840119d646c05edb7880c9f1276f92aa1c4736b","target":{"file":"core/java/android/app/admin/BundlePolicyValue.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["326702412561026300024393815901295686604","156472992673584159090915524232794286114","334149357670228648920450111726280653985","313631074303561151230177818364313802212"]},"id":"ASB-A-515038894-ee6deacf","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/f840119d646c05edb7880c9f1276f92aa1c4736b"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-515038894.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/c6702d96f982bc92527fae085453d83f381f4324"],"severity":"High","spl":"2026-11-01","types":["DoS"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"235811019879431439277195957215880491234","length":46},"id":"ASB-A-515038894-45436e5b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c6702d96f982bc92527fae085453d83f381f4324","target":{"file":"core/java/android/app/admin/BundlePolicyValue.java","function":"BundlePolicyValue"}},{"digest":{"threshold":0.9,"line_hashes":["162650519800005454501044961921539234740","204987794194783212035451606112588096894","158218492816319073545052545840941953302","253509162939209170374914067461442000582","37997544194398040395011945097086673139","7895669008674567970537792357723895015","175579121158468716987440761551257615414","146313485012384398407829236266616846378","60172917206724522744580435407831004335","30378688722491261743343452195783639086","135256857446213728468876247704345105472","128337708091765832135411580191428884993","186118732364553440545191216726505730065"]},"exact_target_file_match_only":true,"id":"ASB-A-515038894-6fb7ffa6","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c6702d96f982bc92527fae085453d83f381f4324","target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/BundlePolicySerializer.java"},"deprecated":false},{"digest":{"function_hash":"335455891683046016734286597225358668526","length":1670},"exact_target_file_match_only":true,"id":"ASB-A-515038894-b73d3501","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c6702d96f982bc92527fae085453d83f381f4324","target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/BundlePolicySerializer.java","function":"writeBundle"},"deprecated":false},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["7540256208188569581567591137097669405","276668691750191631493767332208140405609","73866826183827145965069554117502209911","216518533691095088994719484251726698135"]},"id":"ASB-A-515038894-f6ca83f0","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c6702d96f982bc92527fae085453d83f381f4324","target":{"file":"core/java/android/app/admin/BundlePolicyValue.java"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-515038894.json"}}],"schema_version":"1.9.2"}