{"id":"ASB-A-517376786","details":"In insertInternal of MmsProvider.java, there is a possible multiuser isolation issue due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-517376786","CVE-2026-59005"],"modified":"2026-11-02T16:56:23.615005463Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/packages/providers/TelephonyProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"vanir_signatures":[{"target":{"function":"insertInternal","file":"src/com/android/providers/telephony/MmsProvider.java"},"deprecated":false,"digest":{"length":8559,"function_hash":"156214849804644347597254707875373008715"},"id":"ASB-A-517376786-4bade822","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/a8cf618a797f4b8c33f95434cfff24b71b3a9cd1"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/a8cf618a797f4b8c33f95434cfff24b71b3a9cd1","target":{"file":"src/com/android/providers/telephony/MmsProvider.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["165371737858798706378303122491344422635","337113786514798246550929904010334383677","202560627648877130884950799589197573911","255747255188442027712064021564349237025","11757165687787717149171992205205690414","227306064171168161586737224694258482162","337168207884483463151619114809820328521","153270524520431711887192973279136181317","15313585826727891874419835252423641571","232248485004137106877293995326816625047"]},"id":"ASB-A-517376786-87869f86"}],"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/a8cf618a797f4b8c33f95434cfff24b71b3a9cd1"],"severity":"High","spl":"2026-11-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517376786.json"}},{"package":{"name":"platform/packages/providers/TelephonyProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-517376786-7cfe39e8","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/771fd8dd05872c5e33f66c8074ee4ee9483f8db0","target":{"file":"src/com/android/providers/telephony/MmsProvider.java"},"deprecated":false,"digest":{"line_hashes":["165371737858798706378303122491344422635","337113786514798246550929904010334383677","202560627648877130884950799589197573911","255747255188442027712064021564349237025","11757165687787717149171992205205690414","227306064171168161586737224694258482162","337168207884483463151619114809820328521","153270524520431711887192973279136181317","15313585826727891874419835252423641571","232248485004137106877293995326816625047"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"153315484966539126586283227221069750606","length":7953},"id":"ASB-A-517376786-ee8d2d81","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/771fd8dd05872c5e33f66c8074ee4ee9483f8db0","target":{"file":"src/com/android/providers/telephony/MmsProvider.java","function":"insert"}}],"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/771fd8dd05872c5e33f66c8074ee4ee9483f8db0"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517376786.json"}},{"package":{"name":"platform/packages/providers/TelephonyProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/b7537470465c6d926b2233f77e10db8e907868e5","target":{"file":"src/com/android/providers/telephony/MmsProvider.java"},"deprecated":false,"digest":{"line_hashes":["165371737858798706378303122491344422635","337113786514798246550929904010334383677","202560627648877130884950799589197573911","255747255188442027712064021564349237025","11757165687787717149171992205205690414","227306064171168161586737224694258482162","337168207884483463151619114809820328521","153270524520431711887192973279136181317","15313585826727891874419835252423641571","232248485004137106877293995326816625047"],"threshold":0.9},"id":"ASB-A-517376786-9ca8b79c","signature_type":"Line"},{"target":{"function":"insert","file":"src/com/android/providers/telephony/MmsProvider.java"},"deprecated":false,"digest":{"function_hash":"153315484966539126586283227221069750606","length":7953},"id":"ASB-A-517376786-b2bc2461","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/b7537470465c6d926b2233f77e10db8e907868e5"}],"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/b7537470465c6d926b2233f77e10db8e907868e5"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517376786.json"}},{"package":{"name":"platform/packages/providers/TelephonyProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-517376786-99aa8ee6","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/8f1a95aedc16a6cf4e5e962bf48ca2513292b283","target":{"function":"insert","file":"src/com/android/providers/telephony/MmsProvider.java"},"deprecated":false,"digest":{"function_hash":"153315484966539126586283227221069750606","length":7953}},{"id":"ASB-A-517376786-d98722f3","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/8f1a95aedc16a6cf4e5e962bf48ca2513292b283","target":{"file":"src/com/android/providers/telephony/MmsProvider.java"},"deprecated":false,"digest":{"line_hashes":["165371737858798706378303122491344422635","337113786514798246550929904010334383677","202560627648877130884950799589197573911","255747255188442027712064021564349237025","11757165687787717149171992205205690414","227306064171168161586737224694258482162","337168207884483463151619114809820328521","153270524520431711887192973279136181317","15313585826727891874419835252423641571","232248485004137106877293995326816625047"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/8f1a95aedc16a6cf4e5e962bf48ca2513292b283"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517376786.json"}},{"package":{"name":"platform/packages/providers/TelephonyProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/ccf87fea96d876563a91550908cc52f7e875de2c","target":{"file":"src/com/android/providers/telephony/MmsProvider.java"},"deprecated":false,"digest":{"line_hashes":["165371737858798706378303122491344422635","337113786514798246550929904010334383677","202560627648877130884950799589197573911","255747255188442027712064021564349237025","11757165687787717149171992205205690414","227306064171168161586737224694258482162","337168207884483463151619114809820328521","153270524520431711887192973279136181317","15313585826727891874419835252423641571","232248485004137106877293995326816625047"],"threshold":0.9},"id":"ASB-A-517376786-3f49016b","signature_type":"Line","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/ccf87fea96d876563a91550908cc52f7e875de2c","target":{"file":"src/com/android/providers/telephony/MmsProvider.java","function":"insertInternal"},"deprecated":false,"digest":{"length":8334,"function_hash":"324523338053235110153682363310365262332"},"id":"ASB-A-517376786-fc9870b7","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/ccf87fea96d876563a91550908cc52f7e875de2c"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517376786.json"}},{"package":{"name":"platform/packages/providers/TelephonyProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/3bd751036480b5587c35b31ca8793d522a182d2b","target":{"function":"onCreate","file":"tests/src/com/android/providers/telephony/MmsProviderTestable.java"},"deprecated":false,"digest":{"length":347,"function_hash":"128375384286865543885506875190851250398"},"id":"ASB-A-517376786-3ff39898","match_only_versions":["14"],"signature_type":"Function","signature_version":"v1"},{"target":{"file":"tests/src/com/android/providers/telephony/MmsProviderTestable.java"},"deprecated":false,"digest":{"line_hashes":["92341813134309463289272260392792984826","8743795752542960567718119314988241829","107430036087390426277259555070153984681","23544583397642390845161962434552348612","308823574394497111842622847092175665983","330604452121855729095395075125884761049","209085283751002343099497305733663414717","312241464092371997254470768144213614970","168057132509396101768484154928867783265","184851016950280039341893970385924925085","241173182441427424480787020118558937343","56318560642176097169610264591004903142","180610505612873132798486516720369357944"],"threshold":0.9},"id":"ASB-A-517376786-84d4681a","match_only_versions":["14"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/3bd751036480b5587c35b31ca8793d522a182d2b"},{"digest":{"line_hashes":["165371737858798706378303122491344422635","304894902118299150232926326351325832172","177721061964733622234952234161315065779","130520461954754438968923716599721739349","285474766999274130503098498639136895708","227306064171168161586737224694258482162","337168207884483463151619114809820328521","153270524520431711887192973279136181317","15313585826727891874419835252423641571","232248485004137106877293995326816625047"],"threshold":0.9},"id":"ASB-A-517376786-a1643215","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/3bd751036480b5587c35b31ca8793d522a182d2b","target":{"file":"src/com/android/providers/telephony/MmsProvider.java"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/3bd751036480b5587c35b31ca8793d522a182d2b","target":{"function":"insert","file":"src/com/android/providers/telephony/MmsProvider.java"},"deprecated":false,"digest":{"function_hash":"81514773691457344119100015963312189187","length":7501},"id":"ASB-A-517376786-fc3db5c4","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/3bd751036480b5587c35b31ca8793d522a182d2b"],"severity":"High","spl":"2026-11-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517376786.json"}}],"schema_version":"1.9.2"}