{"id":"ASB-A-517377899","details":"In multiple functions of MediaProvider.java, there is a possible permission bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-517377899","CVE-2026-59022"],"modified":"2026-11-02T17:11:25.311775088Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/packages/providers/MediaProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/38b5f31e0d0a004a3d576f7f98b29745c068a618","target":{"file":"src/com/android/providers/media/MediaProvider.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["209953360167489438498484060877906906192","155541535198085696867029133831430139898","100871931624227977602514027307674634937","259768208645703846781461609266366730149","72268378164092331063015645687561316022","196965724516675642363725470316865324027","169267583860318459804053807572447237358","129786511280483271359350262077713977300","43009747441659237303747052767953451593","90735950840439738617663716195574533173","282647698415292189535539492440340811149","221783584267426551643235511324523511585","136137947571062887190506543785325858198","211058475237760550314397597212884995098","21258271592464335680012163007116204742","146602095698847023728922965153046073943","41759537191693948157585753695656773414","265200440450794954273722569781331158123","45339881867254870512313748493209175687","12767688309764440540439096982950004512","74394490248749579355296953982488683606","334699419466165635377558089491428665497","2272780270277254371794352629412386806","145970561766776575391547319824055644296","320147168395833671434041661227179683870","273625380042653193358713366775614099850","237226397996681296079561070202477047052","2991629795170866614541667633440058124","272692925960332389965564940893935317450","180527328786166261043208365028881110493","185432825636355962936303406377173111761","54796118415759300472809945631680700872","184358150747558661240267227580709812953","90231517237802888612994208472247698713","105835907345857546181088189562284026111","147826753608448169046033363554353830754","20854985853094028616595623075165553064","83866966277403250540015373707385952613"]},"id":"ASB-A-517377899-08fb53e1","signature_type":"Line"},{"source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/38b5f31e0d0a004a3d576f7f98b29745c068a618","target":{"function":"projectionNeedsOwnerPackageFiltering","file":"src/com/android/providers/media/MediaProvider.java"},"deprecated":false,"digest":{"function_hash":"280767482223494536833317989446501322543","length":266},"id":"ASB-A-517377899-2d74bf5f","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/38b5f31e0d0a004a3d576f7f98b29745c068a618","target":{"file":"src/com/android/providers/media/MediaProvider.java","function":"prepareSubstitution"},"deprecated":false,"digest":{"length":559,"function_hash":"61069677978621024458375458398444202969"},"id":"ASB-A-517377899-7049a3f3","signature_type":"Function"},{"source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/38b5f31e0d0a004a3d576f7f98b29745c068a618","target":{"file":"src/com/android/providers/media/MediaProvider.java","function":"constructOwnerPackageNameProjection"},"deprecated":false,"digest":{"length":563,"function_hash":"328755382893244573971748582649241500562"},"id":"ASB-A-517377899-992a8fa2","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/38b5f31e0d0a004a3d576f7f98b29745c068a618"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517377899.json"}},{"package":{"name":"platform/packages/providers/MediaProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/246494747ffa58a6acd4044caef13e0639a8bdf3","target":{"function":"projectionNeedsOwnerPackageFiltering","file":"src/com/android/providers/media/MediaProvider.java"},"deprecated":false,"digest":{"function_hash":"280767482223494536833317989446501322543","length":266},"id":"ASB-A-517377899-0c059a81"},{"target":{"function":"constructOwnerPackageNameProjection","file":"src/com/android/providers/media/MediaProvider.java"},"deprecated":false,"digest":{"function_hash":"328755382893244573971748582649241500562","length":563},"id":"ASB-A-517377899-316e796e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/246494747ffa58a6acd4044caef13e0639a8bdf3"},{"source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/246494747ffa58a6acd4044caef13e0639a8bdf3","target":{"file":"src/com/android/providers/media/MediaProvider.java","function":"queryInternal"},"deprecated":false,"digest":{"function_hash":"96622281522202892651069014947458249587","length":4688},"id":"ASB-A-517377899-554c3d84","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/246494747ffa58a6acd4044caef13e0639a8bdf3","target":{"file":"src/com/android/providers/media/MediaProvider.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["205951154091849508640382500256960715896","314527791780697898571134012782820630150","174605411110642892655775544681384612013","40091899755986319242859224209621181692","319841294773139882971584028068422157612","100871931624227977602514027307674634937","259768208645703846781461609266366730149","72268378164092331063015645687561316022","196965724516675642363725470316865324027","169267583860318459804053807572447237358","129786511280483271359350262077713977300","43009747441659237303747052767953451593","90735950840439738617663716195574533173","282647698415292189535539492440340811149","221783584267426551643235511324523511585","136137947571062887190506543785325858198","211058475237760550314397597212884995098","21258271592464335680012163007116204742","146602095698847023728922965153046073943","41759537191693948157585753695656773414","265200440450794954273722569781331158123","45339881867254870512313748493209175687","163531121680825655324469740192229888595","307219364211887966441674808397930892467","20694691643970836612764681989458612406","12767688309764440540439096982950004512","74394490248749579355296953982488683606","334699419466165635377558089491428665497","2272780270277254371794352629412386806","145970561766776575391547319824055644296","320147168395833671434041661227179683870","273625380042653193358713366775614099850","237226397996681296079561070202477047052","2991629795170866614541667633440058124","339025428082691968074009648292685641425","206252426279668622196747240600354577887","154668583359224652685325821870775348064","163166888442498041557597458867187483373","272692925960332389965564940893935317450","180527328786166261043208365028881110493","185432825636355962936303406377173111761","54796118415759300472809945631680700872","184358150747558661240267227580709812953","90231517237802888612994208472247698713","11936566430602059354760477712178019312","296362791177467999872665390709140999762","331086224422890089569552121593642362290"]},"id":"ASB-A-517377899-75c3e974","signature_type":"Line"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/246494747ffa58a6acd4044caef13e0639a8bdf3","target":{"file":"src/com/android/providers/media/util/SQLiteQueryBuilder.java"},"deprecated":false,"digest":{"line_hashes":["216434170045796828948805504936894542667","322035284204665997382985779268298815857","254099610201678917588906316727067633671","67917690545752534649119548373340769103"],"threshold":0.9},"id":"ASB-A-517377899-7c83f1a8","match_only_versions":["15"],"signature_type":"Line"},{"deprecated":false,"digest":{"length":148,"function_hash":"222085607644333928434203773874021128690"},"id":"ASB-A-517377899-aa202f01","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/246494747ffa58a6acd4044caef13e0639a8bdf3","target":{"function":"maybeReplaceNullProjection","file":"src/com/android/providers/media/MediaProvider.java"}},{"deprecated":false,"digest":{"length":559,"function_hash":"61069677978621024458375458398444202969"},"id":"ASB-A-517377899-ebee4eb2","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/246494747ffa58a6acd4044caef13e0639a8bdf3","target":{"function":"prepareSubstitution","file":"src/com/android/providers/media/MediaProvider.java"}}],"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/246494747ffa58a6acd4044caef13e0639a8bdf3"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517377899.json"}},{"package":{"name":"platform/packages/providers/MediaProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"digest":{"function_hash":"328755382893244573971748582649241500562","length":563},"id":"ASB-A-517377899-3a6efdcd","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/6fc496c0b674749dfc13d5b5c6bb8be0bcbcff64","target":{"file":"src/com/android/providers/media/MediaProvider.java","function":"constructOwnerPackageNameProjection"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/6fc496c0b674749dfc13d5b5c6bb8be0bcbcff64","target":{"file":"src/com/android/providers/media/MediaProvider.java"},"deprecated":false,"digest":{"line_hashes":["209953360167489438498484060877906906192","155541535198085696867029133831430139898","100871931624227977602514027307674634937","259768208645703846781461609266366730149","72268378164092331063015645687561316022","196965724516675642363725470316865324027","169267583860318459804053807572447237358","129786511280483271359350262077713977300","43009747441659237303747052767953451593","90735950840439738617663716195574533173","282647698415292189535539492440340811149","221783584267426551643235511324523511585","136137947571062887190506543785325858198","211058475237760550314397597212884995098","21258271592464335680012163007116204742","146602095698847023728922965153046073943","41759537191693948157585753695656773414","265200440450794954273722569781331158123","45339881867254870512313748493209175687","12767688309764440540439096982950004512","74394490248749579355296953982488683606","334699419466165635377558089491428665497","2272780270277254371794352629412386806","145970561766776575391547319824055644296","320147168395833671434041661227179683870","273625380042653193358713366775614099850","237226397996681296079561070202477047052","2991629795170866614541667633440058124","272692925960332389965564940893935317450","180527328786166261043208365028881110493","185432825636355962936303406377173111761","54796118415759300472809945631680700872","184358150747558661240267227580709812953","90231517237802888612994208472247698713","177128060047474198496151451379606475287","245866910055997376492285387307470648670","73142059349959072805283796948982379478","244449675547562246772899698981459876180"],"threshold":0.9},"id":"ASB-A-517377899-557bcc46"},{"id":"ASB-A-517377899-5a038487","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/6fc496c0b674749dfc13d5b5c6bb8be0bcbcff64","target":{"file":"src/com/android/providers/media/MediaProvider.java","function":"projectionNeedsOwnerPackageFiltering"},"deprecated":false,"digest":{"length":266,"function_hash":"280767482223494536833317989446501322543"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/6fc496c0b674749dfc13d5b5c6bb8be0bcbcff64","target":{"function":"prepareSubstitution","file":"src/com/android/providers/media/MediaProvider.java"},"deprecated":false,"digest":{"function_hash":"61069677978621024458375458398444202969","length":559},"id":"ASB-A-517377899-b01efd3a","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/6fc496c0b674749dfc13d5b5c6bb8be0bcbcff64"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517377899.json"}},{"package":{"name":"platform/packages/providers/MediaProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"types":["ID"],"vanir_signatures":[{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["209953360167489438498484060877906906192","155541535198085696867029133831430139898","100871931624227977602514027307674634937","259768208645703846781461609266366730149","72268378164092331063015645687561316022","196965724516675642363725470316865324027","169267583860318459804053807572447237358","129786511280483271359350262077713977300","43009747441659237303747052767953451593","90735950840439738617663716195574533173","282647698415292189535539492440340811149","221783584267426551643235511324523511585","136137947571062887190506543785325858198","211058475237760550314397597212884995098","21258271592464335680012163007116204742","146602095698847023728922965153046073943","41759537191693948157585753695656773414","265200440450794954273722569781331158123","45339881867254870512313748493209175687","12767688309764440540439096982950004512","74394490248749579355296953982488683606","334699419466165635377558089491428665497","2272780270277254371794352629412386806","145970561766776575391547319824055644296","320147168395833671434041661227179683870","273625380042653193358713366775614099850","237226397996681296079561070202477047052","2991629795170866614541667633440058124","272692925960332389965564940893935317450","180527328786166261043208365028881110493","185432825636355962936303406377173111761","54796118415759300472809945631680700872","184358150747558661240267227580709812953","90231517237802888612994208472247698713","177128060047474198496151451379606475287","245866910055997376492285387307470648670","73142059349959072805283796948982379478","244449675547562246772899698981459876180"]},"id":"ASB-A-517377899-0f7e0bd4","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/348525fae4b10570e87dd7e86e9718c58b58e6c2","target":{"file":"src/com/android/providers/media/MediaProvider.java"}},{"source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/348525fae4b10570e87dd7e86e9718c58b58e6c2","target":{"file":"src/com/android/providers/media/MediaProvider.java","function":"projectionNeedsOwnerPackageFiltering"},"deprecated":false,"digest":{"function_hash":"280767482223494536833317989446501322543","length":266},"id":"ASB-A-517377899-60bf16e8","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/348525fae4b10570e87dd7e86e9718c58b58e6c2","target":{"file":"src/com/android/providers/media/MediaProvider.java","function":"prepareSubstitution"},"deprecated":false,"digest":{"length":559,"function_hash":"61069677978621024458375458398444202969"},"id":"ASB-A-517377899-816e40f9","signature_type":"Function"},{"digest":{"function_hash":"328755382893244573971748582649241500562","length":563},"id":"ASB-A-517377899-b7454db0","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/348525fae4b10570e87dd7e86e9718c58b58e6c2","target":{"file":"src/com/android/providers/media/MediaProvider.java","function":"constructOwnerPackageNameProjection"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/348525fae4b10570e87dd7e86e9718c58b58e6c2"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517377899.json"}},{"package":{"name":"platform/packages/providers/MediaProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/cb4568acda272a17182ae4662409001338f2002a"],"severity":"High","spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/cb4568acda272a17182ae4662409001338f2002a","target":{"function":"projectionNeedsOwnerPackageFiltering","file":"src/com/android/providers/media/MediaProvider.java"},"deprecated":false,"digest":{"function_hash":"280767482223494536833317989446501322543","length":266},"id":"ASB-A-517377899-6291166d","signature_type":"Function"},{"deprecated":false,"digest":{"length":563,"function_hash":"328755382893244573971748582649241500562"},"id":"ASB-A-517377899-b09a2855","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/cb4568acda272a17182ae4662409001338f2002a","target":{"file":"src/com/android/providers/media/MediaProvider.java","function":"constructOwnerPackageNameProjection"}},{"target":{"file":"src/com/android/providers/media/MediaProvider.java"},"deprecated":false,"digest":{"line_hashes":["209953360167489438498484060877906906192","155541535198085696867029133831430139898","100871931624227977602514027307674634937","259768208645703846781461609266366730149","72268378164092331063015645687561316022","196965724516675642363725470316865324027","169267583860318459804053807572447237358","129786511280483271359350262077713977300","43009747441659237303747052767953451593","90735950840439738617663716195574533173","282647698415292189535539492440340811149","221783584267426551643235511324523511585","136137947571062887190506543785325858198","211058475237760550314397597212884995098","21258271592464335680012163007116204742","146602095698847023728922965153046073943","41759537191693948157585753695656773414","265200440450794954273722569781331158123","45339881867254870512313748493209175687","12767688309764440540439096982950004512","74394490248749579355296953982488683606","334699419466165635377558089491428665497","2272780270277254371794352629412386806","145970561766776575391547319824055644296","320147168395833671434041661227179683870","273625380042653193358713366775614099850","237226397996681296079561070202477047052","2991629795170866614541667633440058124","272692925960332389965564940893935317450","180527328786166261043208365028881110493","185432825636355962936303406377173111761","54796118415759300472809945631680700872","184358150747558661240267227580709812953","90231517237802888612994208472247698713","105835907345857546181088189562284026111","147826753608448169046033363554353830754","20854985853094028616595623075165553064","83866966277403250540015373707385952613"],"threshold":0.9},"id":"ASB-A-517377899-e91e3b06","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/cb4568acda272a17182ae4662409001338f2002a"},{"source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/cb4568acda272a17182ae4662409001338f2002a","target":{"file":"src/com/android/providers/media/MediaProvider.java","function":"prepareSubstitution"},"deprecated":false,"digest":{"length":559,"function_hash":"61069677978621024458375458398444202969"},"id":"ASB-A-517377899-ed151aec","signature_type":"Function","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517377899.json"}}],"schema_version":"1.9.2"}