{"id":"PUB-A-229742774","details":"In CanvasContext::draw of CanvasContext.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.","aliases":["A-229742774","CVE-2022-20526"],"modified":"2026-09-25T15:22:44.054146853Z","published":"2022-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-12-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/5d28aee1b1ac76e73db174535802bd2cc6069909"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2022-12-01"}]}],"versions":["13"],"ecosystem_specific":{"vanir_signatures":[{"digest":{"line_hashes":["332575304169604046373995395576761201456","329301664017695044908573214346195847286","257037388195589102935482116407481014853","171455927107890126776726322188613058790"],"threshold":0.9},"id":"PUB-A-229742774-103e86d9","match_only_versions":["13"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5d28aee1b1ac76e73db174535802bd2cc6069909","target":{"file":"libs/hwui/FrameInfoVisualizer.cpp"},"deprecated":false},{"digest":{"function_hash":"77236501572456398032443108328482488218","length":638},"id":"PUB-A-229742774-590cae2c","match_only_versions":["13"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5d28aee1b1ac76e73db174535802bd2cc6069909","target":{"function":"FrameInfoVisualizer::nextBarSegment","file":"libs/hwui/FrameInfoVisualizer.cpp"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5d28aee1b1ac76e73db174535802bd2cc6069909","target":{"file":"libs/hwui/renderthread/CanvasContext.cpp","function":"CanvasContext::onSurfaceStatsAvailable"},"deprecated":false,"digest":{"function_hash":"4570008046076987509615668333020167213","length":860},"id":"PUB-A-229742774-85194b62","signature_type":"Function"},{"target":{"file":"libs/hwui/renderthread/CanvasContext.cpp"},"deprecated":false,"digest":{"line_hashes":["136036484645580033590034926786381783113","286182598713294241382167997903296974850","208520091836852653793089187179183660920","34495167826175740236009714883912152891","176910068477763083712927446041636024693","235146050989470696510493056667434466956","134755034926969709763907032505494704978","132608253427553793286476480970960557634","8956288746563152474906955038773292284","103188423544935536618636123577602863303","33958679328751432236185906336983336374","248517836361100168985139186596235949564","94596338033748485168029896863827351169","126662666419580173960697217552828704436","244759753838698840204309196174112839226"],"threshold":0.9},"id":"PUB-A-229742774-956cbf37","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5d28aee1b1ac76e73db174535802bd2cc6069909"},{"digest":{"length":4629,"function_hash":"21084141182325107831168949708426691438"},"id":"PUB-A-229742774-981a678e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5d28aee1b1ac76e73db174535802bd2cc6069909","target":{"file":"libs/hwui/renderthread/CanvasContext.cpp","function":"CanvasContext::draw"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/5d28aee1b1ac76e73db174535802bd2cc6069909"],"severity":"Low","spl":"2022-12-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-229742774.json"}}],"schema_version":"1.9.0"}