{"id":"ASB-A-517377188","details":"In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-517377188","CVE-2026-58885"],"modified":"2026-11-02T17:11:24.037634787Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/79de22baeaabe3755b2ed7f53dbfe279af5072b1","target":{"file":"telephony/java/android/telephony/MessageUpgradeWorker.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["192334803586406572466802084148419857676","39686420332125227020535007959332999098","169861343134086171443577330211634089440","300753107145088696756291336078765703287"]},"id":"ASB-A-517377188-3e0a461e","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"248307518036084805420821067107083208791","length":277},"id":"ASB-A-517377188-93724d74","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/79de22baeaabe3755b2ed7f53dbfe279af5072b1","target":{"file":"telephony/java/android/telephony/MessageUpgradeWorker.java","function":"parseMessageType"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/79de22baeaabe3755b2ed7f53dbfe279af5072b1"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517377188.json"}},{"package":{"name":"platform/packages/services/Mms","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Mms/+/7ad5c63b37d4ccdc380f573776474996aa2e7dd4","target":{"file":"src/com/android/mms/service/SendRequest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["239368870437854594361816294904728630795","230623596135820436007893927798398352792","23393265984381959920998940613962702036","243998206070416019997524406462652032002"]},"id":"ASB-A-517377188-75cd1412","signature_type":"Line"},{"source":"https://android.googlesource.com/platform/packages/services/Mms/+/7ad5c63b37d4ccdc380f573776474996aa2e7dd4","target":{"file":"src/com/android/mms/service/SendRequest.java","function":"persistIfRequired"},"deprecated":false,"digest":{"length":3436,"function_hash":"60606403688364862915400305594430009893"},"id":"ASB-A-517377188-7f11c88b","match_only_versions":["17-qpr2-next"],"signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/services/Mms/+/7ad5c63b37d4ccdc380f573776474996aa2e7dd4"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517377188.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/436f10ea3fbd720d361db81a2e98b801a34bd879"],"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"248307518036084805420821067107083208791","length":277},"id":"ASB-A-517377188-24c53cd0","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/436f10ea3fbd720d361db81a2e98b801a34bd879","target":{"function":"parseMessageType","file":"telephony/java/android/telephony/MessageUpgradeWorker.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/436f10ea3fbd720d361db81a2e98b801a34bd879","target":{"file":"telephony/java/android/telephony/MessageUpgradeWorker.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["192334803586406572466802084148419857676","39686420332125227020535007959332999098","169861343134086171443577330211634089440","300753107145088696756291336078765703287"]},"id":"ASB-A-517377188-d33f67ff"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517377188.json"}},{"package":{"name":"platform/packages/services/Mms","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"src/com/android/mms/service/SendRequest.java"},"deprecated":false,"digest":{"line_hashes":["239368870437854594361816294904728630795","230623596135820436007893927798398352792","23393265984381959920998940613962702036","243998206070416019997524406462652032002"],"threshold":0.9},"id":"ASB-A-517377188-b92b87c8","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Mms/+/331790e3508cc15d3011953c54b03284ffb9785a"}],"fixes":["https://android.googlesource.com/platform/packages/services/Mms/+/331790e3508cc15d3011953c54b03284ffb9785a"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517377188.json"}}],"schema_version":"1.9.2"}