{"id":"ASB-A-515712425","details":"In checkDestination of SmsUsageMonitor.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-515712425","CVE-2026-58964"],"modified":"2026-11-02T16:56:19.528200725Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/e6e62211da4f9ee2fa644ea02b607edc9f3cae8c"],"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-515712425-127ab9f7","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/e6e62211da4f9ee2fa644ea02b607edc9f3cae8c","target":{"file":"src/java/com/android/internal/telephony/SmsUsageMonitor.java","function":"checkDestination"},"deprecated":false,"digest":{"length":1439,"function_hash":"296638958761094864193970183462327384912"}},{"source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/e6e62211da4f9ee2fa644ea02b607edc9f3cae8c","target":{"file":"src/java/com/android/internal/telephony/SmsUsageMonitor.java"},"deprecated":false,"digest":{"line_hashes":["278866342898281575859739499010048378672","152653872370625791126753809537305123347","323696478722054455160265477005009271833","105980278909833987128848098333978565198"],"threshold":0.9},"id":"ASB-A-515712425-5dd221d5","signature_type":"Line","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-515712425.json"}},{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"length":1359,"function_hash":"198002522420519632856240698289617733578"},"id":"ASB-A-515712425-34bb4a8b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/c14a3539fd92fa8c64ad3790a06a31c6292ad73c","target":{"file":"src/java/com/android/internal/telephony/SmsUsageMonitor.java","function":"checkDestination"}},{"id":"ASB-A-515712425-418b2ceb","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/c14a3539fd92fa8c64ad3790a06a31c6292ad73c","target":{"file":"src/java/com/android/internal/telephony/SmsUsageMonitor.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["278866342898281575859739499010048378672","152653872370625791126753809537305123347","21595000393728852658924036448522328509","184071510294647729346726695068691204073"]}}],"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/c14a3539fd92fa8c64ad3790a06a31c6292ad73c"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-515712425.json"}},{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/451ccf296b4e3381253f2de2cb4b6984cdfee4ce"],"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/451ccf296b4e3381253f2de2cb4b6984cdfee4ce","target":{"file":"src/java/com/android/internal/telephony/SmsUsageMonitor.java","function":"checkDestination"},"deprecated":false,"digest":{"function_hash":"296638958761094864193970183462327384912","length":1439},"id":"ASB-A-515712425-61dbab93","signature_type":"Function","signature_version":"v1"},{"target":{"file":"src/java/com/android/internal/telephony/SmsUsageMonitor.java"},"deprecated":false,"digest":{"line_hashes":["278866342898281575859739499010048378672","152653872370625791126753809537305123347","323696478722054455160265477005009271833","105980278909833987128848098333978565198"],"threshold":0.9},"id":"ASB-A-515712425-d41b1150","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/451ccf296b4e3381253f2de2cb4b6984cdfee4ce"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-515712425.json"}},{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/6cca82ff4c2741e4ce5c58d768101ea9851c3d27","target":{"file":"src/java/com/android/internal/telephony/SmsUsageMonitor.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["278866342898281575859739499010048378672","152653872370625791126753809537305123347","323696478722054455160265477005009271833","105980278909833987128848098333978565198"]},"id":"ASB-A-515712425-222e6b81"},{"target":{"file":"src/java/com/android/internal/telephony/SmsUsageMonitor.java","function":"checkDestination"},"deprecated":false,"digest":{"function_hash":"296638958761094864193970183462327384912","length":1439},"id":"ASB-A-515712425-e01945e4","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/6cca82ff4c2741e4ce5c58d768101ea9851c3d27"}],"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/6cca82ff4c2741e4ce5c58d768101ea9851c3d27"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-515712425.json"}},{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"target":{"file":"src/java/com/android/internal/telephony/SmsUsageMonitor.java"},"deprecated":false,"digest":{"line_hashes":["278866342898281575859739499010048378672","152653872370625791126753809537305123347","323696478722054455160265477005009271833","105980278909833987128848098333978565198"],"threshold":0.9},"id":"ASB-A-515712425-4be6b7e2","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/ef002f31e460aa468906812aa152d6ea693b9ce7"},{"id":"ASB-A-515712425-c3902513","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/ef002f31e460aa468906812aa152d6ea693b9ce7","target":{"function":"checkDestination","file":"src/java/com/android/internal/telephony/SmsUsageMonitor.java"},"deprecated":false,"digest":{"length":1439,"function_hash":"296638958761094864193970183462327384912"}}],"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/ef002f31e460aa468906812aa152d6ea693b9ce7"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-515712425.json"}},{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/c6b9fd188c377c2a2ec5b579be0e5e877137acb9","target":{"file":"src/java/com/android/internal/telephony/SmsUsageMonitor.java"},"deprecated":false,"digest":{"line_hashes":["278866342898281575859739499010048378672","152653872370625791126753809537305123347","21595000393728852658924036448522328509","184071510294647729346726695068691204073"],"threshold":0.9},"id":"ASB-A-515712425-491ef46d","signature_type":"Line"},{"id":"ASB-A-515712425-ba1a8ba5","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/c6b9fd188c377c2a2ec5b579be0e5e877137acb9","target":{"file":"src/java/com/android/internal/telephony/SmsUsageMonitor.java","function":"checkDestination"},"deprecated":false,"digest":{"length":1359,"function_hash":"198002522420519632856240698289617733578"}}],"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/c6b9fd188c377c2a2ec5b579be0e5e877137acb9"],"severity":"High","spl":"2026-11-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-515712425.json"}}],"schema_version":"1.9.2"}