{"id":"ASB-A-517377278","details":"In validEfCfis of SIMRecords.java, there is a possible way to cause a denial of service due to an uncaught exception. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-517377278","CVE-2026-55288"],"modified":"2026-11-02T17:11:25.534848808Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/4381d4ce8475af635b0b21e0525779bdd03e2ca7","target":{"file":"src/java/com/android/internal/telephony/uicc/SIMRecords.java","function":"setVoiceCallForwardingFlag"},"deprecated":false,"digest":{"function_hash":"126249746677518955733109791714270341886","length":1720},"id":"ASB-A-517377278-165b67a8","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/4381d4ce8475af635b0b21e0525779bdd03e2ca7","target":{"file":"src/java/com/android/internal/telephony/uicc/SIMRecords.java"},"deprecated":false,"digest":{"line_hashes":["94293593232553245680801587962646917542","227374904786974250589687114333500051790","109944487236181279124266932198374934765","157352236247571745860985081772193877639","281801710888966841773845400288702892486","225613602241600149532773240720006409364","108192695439672716420877078500701290382","32760533876036919239896109806654011481","271734709383191658144661102384468508827","154558889169601441311869499930447332230","180362258779970406168762849926819373345","132986246169147886694019341514505540921","273768173687729145703900330794281010235","149362516570823705063207521162840887295","215792057953140846310360657726566616055","44124080432128822618389200534704798238","61057224393523301069158742672997702174","83458954247723361486747776260706761408","314408253223728611917181139562969513961","283136512124576705020880690027672963878","277287106900183711793352583649584185898","179477863274485167735248531613174393340","181201224934184210049124616776464535475","26708302782068696444724616119015969461","268855259965380843249654654354647917713","218907098639815212775526174335779642227","106170575797933926987901866616041299602"],"threshold":0.9},"id":"ASB-A-517377278-4ac441da"},{"source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/4381d4ce8475af635b0b21e0525779bdd03e2ca7","target":{"function":"setVoiceCallForwardingFlagFromSimRecords","file":"src/java/com/android/internal/telephony/uicc/SIMRecords.java"},"deprecated":false,"digest":{"function_hash":"57833559330800300584246310515540871865","length":600},"id":"ASB-A-517377278-bde8594d","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"274344632667267348699829748469948338955","length":270},"id":"ASB-A-517377278-ff2b5f98","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/4381d4ce8475af635b0b21e0525779bdd03e2ca7","target":{"file":"src/java/com/android/internal/telephony/uicc/SIMRecords.java","function":"validEfCfis"}}],"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/4381d4ce8475af635b0b21e0525779bdd03e2ca7"],"severity":"High","spl":"2026-11-01","types":["DoS"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517377278.json"}},{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/bc4614086cac650f3960a88db78328ad9e86f7c5"],"severity":"High","spl":"2026-11-01","types":["DoS"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/bc4614086cac650f3960a88db78328ad9e86f7c5","target":{"function":"setVoiceCallForwardingFlagFromSimRecords","file":"src/java/com/android/internal/telephony/uicc/SIMRecords.java"},"deprecated":false,"digest":{"length":600,"function_hash":"57833559330800300584246310515540871865"},"id":"ASB-A-517377278-2e2249a0","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"126249746677518955733109791714270341886","length":1720},"id":"ASB-A-517377278-701f1c00","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/bc4614086cac650f3960a88db78328ad9e86f7c5","target":{"file":"src/java/com/android/internal/telephony/uicc/SIMRecords.java","function":"setVoiceCallForwardingFlag"},"deprecated":false},{"target":{"file":"src/java/com/android/internal/telephony/uicc/SIMRecords.java","function":"validEfCfis"},"deprecated":false,"digest":{"function_hash":"274344632667267348699829748469948338955","length":270},"id":"ASB-A-517377278-80f0075b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/bc4614086cac650f3960a88db78328ad9e86f7c5"},{"deprecated":false,"digest":{"line_hashes":["32760533876036919239896109806654011481","271734709383191658144661102384468508827","154558889169601441311869499930447332230","180362258779970406168762849926819373345","132986246169147886694019341514505540921","273768173687729145703900330794281010235","149362516570823705063207521162840887295","215792057953140846310360657726566616055","44124080432128822618389200534704798238","61057224393523301069158742672997702174","83458954247723361486747776260706761408","314408253223728611917181139562969513961","283136512124576705020880690027672963878","277287106900183711793352583649584185898","179477863274485167735248531613174393340","181201224934184210049124616776464535475","26708302782068696444724616119015969461","268855259965380843249654654354647917713","218907098639815212775526174335779642227","106170575797933926987901866616041299602"],"threshold":0.9},"id":"ASB-A-517377278-fdeb826f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/bc4614086cac650f3960a88db78328ad9e86f7c5","target":{"file":"src/java/com/android/internal/telephony/uicc/SIMRecords.java"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517377278.json"}},{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/5a45e108f2ccad5ef55b36ee9ebfde9e3d476bdd"],"severity":"High","spl":"2026-11-01","types":["DoS"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/5a45e108f2ccad5ef55b36ee9ebfde9e3d476bdd","target":{"file":"src/java/com/android/internal/telephony/uicc/SIMRecords.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["32760533876036919239896109806654011481","271734709383191658144661102384468508827","154558889169601441311869499930447332230","180362258779970406168762849926819373345","132986246169147886694019341514505540921","273768173687729145703900330794281010235","149362516570823705063207521162840887295","215792057953140846310360657726566616055","44124080432128822618389200534704798238","61057224393523301069158742672997702174","83458954247723361486747776260706761408","314408253223728611917181139562969513961","283136512124576705020880690027672963878","277287106900183711793352583649584185898","179477863274485167735248531613174393340","181201224934184210049124616776464535475","26708302782068696444724616119015969461","268855259965380843249654654354647917713","218907098639815212775526174335779642227","106170575797933926987901866616041299602"]},"id":"ASB-A-517377278-60fc47dc","signature_type":"Line"},{"digest":{"length":600,"function_hash":"57833559330800300584246310515540871865"},"id":"ASB-A-517377278-6b281d19","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/5a45e108f2ccad5ef55b36ee9ebfde9e3d476bdd","target":{"file":"src/java/com/android/internal/telephony/uicc/SIMRecords.java","function":"setVoiceCallForwardingFlagFromSimRecords"},"deprecated":false},{"target":{"file":"src/java/com/android/internal/telephony/uicc/SIMRecords.java","function":"validEfCfis"},"deprecated":false,"digest":{"length":270,"function_hash":"274344632667267348699829748469948338955"},"id":"ASB-A-517377278-cbb93c6d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/5a45e108f2ccad5ef55b36ee9ebfde9e3d476bdd"},{"deprecated":false,"digest":{"length":1720,"function_hash":"126249746677518955733109791714270341886"},"id":"ASB-A-517377278-df1d1a42","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/5a45e108f2ccad5ef55b36ee9ebfde9e3d476bdd","target":{"function":"setVoiceCallForwardingFlag","file":"src/java/com/android/internal/telephony/uicc/SIMRecords.java"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517377278.json"}},{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/b47855739038904a6a7f35dcf3852f037055f972"],"severity":"High","spl":"2026-11-01","types":["DoS"],"vanir_signatures":[{"digest":{"function_hash":"274344632667267348699829748469948338955","length":270},"id":"ASB-A-517377278-29373e14","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/b47855739038904a6a7f35dcf3852f037055f972","target":{"file":"src/java/com/android/internal/telephony/uicc/SIMRecords.java","function":"validEfCfis"},"deprecated":false},{"target":{"file":"src/java/com/android/internal/telephony/uicc/SIMRecords.java"},"deprecated":false,"digest":{"line_hashes":["32760533876036919239896109806654011481","271734709383191658144661102384468508827","154558889169601441311869499930447332230","180362258779970406168762849926819373345","132986246169147886694019341514505540921","273768173687729145703900330794281010235","149362516570823705063207521162840887295","215792057953140846310360657726566616055","44124080432128822618389200534704798238","61057224393523301069158742672997702174","83458954247723361486747776260706761408","314408253223728611917181139562969513961","283136512124576705020880690027672963878","277287106900183711793352583649584185898","179477863274485167735248531613174393340","181201224934184210049124616776464535475","26708302782068696444724616119015969461","268855259965380843249654654354647917713","218907098639815212775526174335779642227","106170575797933926987901866616041299602"],"threshold":0.9},"id":"ASB-A-517377278-3ded0a4e","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/b47855739038904a6a7f35dcf3852f037055f972"},{"digest":{"length":600,"function_hash":"57833559330800300584246310515540871865"},"id":"ASB-A-517377278-4e7cf148","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/b47855739038904a6a7f35dcf3852f037055f972","target":{"file":"src/java/com/android/internal/telephony/uicc/SIMRecords.java","function":"setVoiceCallForwardingFlagFromSimRecords"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/b47855739038904a6a7f35dcf3852f037055f972","target":{"file":"src/java/com/android/internal/telephony/uicc/SIMRecords.java","function":"setVoiceCallForwardingFlag"},"deprecated":false,"digest":{"length":1720,"function_hash":"126249746677518955733109791714270341886"},"id":"ASB-A-517377278-83ab3d47"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517377278.json"}},{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"vanir_signatures":[{"digest":{"function_hash":"126249746677518955733109791714270341886","length":1720},"id":"ASB-A-517377278-39227dfd","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/645a5868193e3009bc8000dcbe68b3d8dcedb0d2","target":{"file":"src/java/com/android/internal/telephony/uicc/SIMRecords.java","function":"setVoiceCallForwardingFlag"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/645a5868193e3009bc8000dcbe68b3d8dcedb0d2","target":{"file":"src/java/com/android/internal/telephony/uicc/SIMRecords.java"},"deprecated":false,"digest":{"line_hashes":["32760533876036919239896109806654011481","271734709383191658144661102384468508827","154558889169601441311869499930447332230","180362258779970406168762849926819373345","132986246169147886694019341514505540921","273768173687729145703900330794281010235","149362516570823705063207521162840887295","215792057953140846310360657726566616055","44124080432128822618389200534704798238","61057224393523301069158742672997702174","83458954247723361486747776260706761408","314408253223728611917181139562969513961","283136512124576705020880690027672963878","277287106900183711793352583649584185898","179477863274485167735248531613174393340","181201224934184210049124616776464535475","26708302782068696444724616119015969461","268855259965380843249654654354647917713","218907098639815212775526174335779642227","106170575797933926987901866616041299602"],"threshold":0.9},"id":"ASB-A-517377278-3b1cbe04","signature_type":"Line"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/645a5868193e3009bc8000dcbe68b3d8dcedb0d2","target":{"file":"src/java/com/android/internal/telephony/uicc/SIMRecords.java","function":"setVoiceCallForwardingFlagFromSimRecords"},"deprecated":false,"digest":{"function_hash":"57833559330800300584246310515540871865","length":600},"id":"ASB-A-517377278-6e0b72cd","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/645a5868193e3009bc8000dcbe68b3d8dcedb0d2","target":{"function":"validEfCfis","file":"src/java/com/android/internal/telephony/uicc/SIMRecords.java"},"deprecated":false,"digest":{"function_hash":"274344632667267348699829748469948338955","length":270},"id":"ASB-A-517377278-c3bf8819","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/645a5868193e3009bc8000dcbe68b3d8dcedb0d2"],"severity":"High","spl":"2026-11-01","types":["DoS"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517377278.json"}},{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2026-11-01","types":["DoS"],"vanir_signatures":[{"digest":{"length":600,"function_hash":"57833559330800300584246310515540871865"},"id":"ASB-A-517377278-14a7e9c4","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/7e4ba782d1745140e61eec9636ecdccd618aa5bb","target":{"function":"setVoiceCallForwardingFlagFromSimRecords","file":"src/java/com/android/internal/telephony/uicc/SIMRecords.java"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/7e4ba782d1745140e61eec9636ecdccd618aa5bb","target":{"function":"setVoiceCallForwardingFlag","file":"src/java/com/android/internal/telephony/uicc/SIMRecords.java"},"deprecated":false,"digest":{"length":1720,"function_hash":"126249746677518955733109791714270341886"},"id":"ASB-A-517377278-21456830"},{"target":{"file":"src/java/com/android/internal/telephony/uicc/SIMRecords.java"},"deprecated":false,"digest":{"line_hashes":["32760533876036919239896109806654011481","271734709383191658144661102384468508827","154558889169601441311869499930447332230","180362258779970406168762849926819373345","132986246169147886694019341514505540921","273768173687729145703900330794281010235","149362516570823705063207521162840887295","215792057953140846310360657726566616055","44124080432128822618389200534704798238","61057224393523301069158742672997702174","83458954247723361486747776260706761408","314408253223728611917181139562969513961","283136512124576705020880690027672963878","277287106900183711793352583649584185898","179477863274485167735248531613174393340","181201224934184210049124616776464535475","26708302782068696444724616119015969461","268855259965380843249654654354647917713","218907098639815212775526174335779642227","106170575797933926987901866616041299602"],"threshold":0.9},"id":"ASB-A-517377278-52b06da6","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/7e4ba782d1745140e61eec9636ecdccd618aa5bb"},{"digest":{"length":270,"function_hash":"274344632667267348699829748469948338955"},"id":"ASB-A-517377278-bd3d1865","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/7e4ba782d1745140e61eec9636ecdccd618aa5bb","target":{"function":"validEfCfis","file":"src/java/com/android/internal/telephony/uicc/SIMRecords.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/7e4ba782d1745140e61eec9636ecdccd618aa5bb"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517377278.json"}}],"schema_version":"1.9.2"}