{"id":"ASB-A-269456968", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-02T16:38:00.081625681Z", "aliases":["CVE-2026-58988", "A-269456968"], "details":"In isValid of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/hardware/interfaces", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/hardware/interfaces/+/54ed71c54672af6e1806d5cbc58ab8e38137c4ba"], "severity":"High", "spl":"2026-11-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["40592511717342990389942058539945609306", "1215199241451092441693081628498869121", "129948529691575016124142609218851295746", "180984362077311833556099534600156618805", "196474455315920770780076363565407616005", "7710838437947647161968512562153547620", "289101019889694858839139463180580597518"], "threshold":0.9}, "id":"ASB-A-269456968-8ee0ac38", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/interfaces/+/54ed71c54672af6e1806d5cbc58ab8e38137c4ba", "target":{"file":"neuralnetworks/aidl/vts/functional/ValidateModel.cpp"}}, {"deprecated":false, "digest":{"function_hash":"255834689267382053440549860468519338361", "length":840}, "id":"ASB-A-269456968-baa82bfd", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/interfaces/+/54ed71c54672af6e1806d5cbc58ab8e38137c4ba", "target":{"file":"neuralnetworks/aidl/vts/functional/ValidateModel.cpp", "function":"validateModel"}}]}}, {"package":{"name":"platform/packages/modules/NeuralNetworks", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/3aedb5493147609aca83519618e7cf0bf33c2123"], "severity":"High", "spl":"2026-11-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"117549551585405145896197857986194020165", "length":2040}, "id":"ASB-A-269456968-56a726db", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/3aedb5493147609aca83519618e7cf0bf33c2123", "target":{"file":"shim_and_sl/ShimConverter.cpp", "function":"isValid"}}, {"deprecated":false, "digest":{"line_hashes":["75187719208275870646090957093481890954", "340131414929134843437663854480429539680", "54001838752359329900919718142955712081", "285250356260115474433082804678168617461", "109424735767730076176734673742369407379", "39573811633329355338794009495144039177", "182830228131374686493677244538863397532", "98379926951023035715857893892377015667", "188637344271475611293398993770431629553", "229387678612352843714756599500284039861", "85359450305213975842027923137755667731", "220001508687791037264125116951112954330", "324735370805818494230502263013918886225", "101085154751499475628652996322645265504", "67375320668609752978282465410270834414", "120552197073837783068915436307065730213", "126287348359886453068673444172571704445", "50757414922992344976773212318036965487"], "threshold":0.9}, "id":"ASB-A-269456968-61aabd5f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/3aedb5493147609aca83519618e7cf0bf33c2123", "target":{"file":"shim_and_sl/ShimConverter.cpp"}}]}}, {"package":{"name":"platform/hardware/interfaces", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-11-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/hardware/interfaces/+/f175a9842907a57cf98f238dbd64022dcb1acd4f"], "severity":"High", "spl":"2026-11-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"255834689267382053440549860468519338361", "length":840}, "id":"ASB-A-269456968-13286ff3", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/interfaces/+/f175a9842907a57cf98f238dbd64022dcb1acd4f", "target":{"file":"neuralnetworks/aidl/vts/functional/ValidateModel.cpp", "function":"validateModel"}}, {"deprecated":false, "digest":{"line_hashes":["40592511717342990389942058539945609306", "1215199241451092441693081628498869121", "129948529691575016124142609218851295746", "180984362077311833556099534600156618805", "196474455315920770780076363565407616005", "7710838437947647161968512562153547620", "289101019889694858839139463180580597518"], "threshold":0.9}, "id":"ASB-A-269456968-48621dd5", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/interfaces/+/f175a9842907a57cf98f238dbd64022dcb1acd4f", "target":{"file":"neuralnetworks/aidl/vts/functional/ValidateModel.cpp"}}]}}, {"package":{"name":"platform/packages/modules/NeuralNetworks", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-11-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/b6fa7d7c01b682ca744a23762ce846427ad1135b"], "severity":"High", "spl":"2026-11-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"117549551585405145896197857986194020165", "length":2040}, "id":"ASB-A-269456968-b2779a72", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/b6fa7d7c01b682ca744a23762ce846427ad1135b", "target":{"file":"shim_and_sl/ShimConverter.cpp", "function":"isValid"}}, {"deprecated":false, "digest":{"line_hashes":["75187719208275870646090957093481890954", "340131414929134843437663854480429539680", "54001838752359329900919718142955712081", "285250356260115474433082804678168617461", "109424735767730076176734673742369407379", "39573811633329355338794009495144039177", "182830228131374686493677244538863397532", "98379926951023035715857893892377015667", "188637344271475611293398993770431629553", "229387678612352843714756599500284039861", "85359450305213975842027923137755667731", "220001508687791037264125116951112954330", "324735370805818494230502263013918886225", "101085154751499475628652996322645265504", "67375320668609752978282465410270834414", "120552197073837783068915436307065730213", "126287348359886453068673444172571704445", "50757414922992344976773212318036965487"], "threshold":0.9}, "id":"ASB-A-269456968-b74e00fa", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/b6fa7d7c01b682ca744a23762ce846427ad1135b", "target":{"file":"shim_and_sl/ShimConverter.cpp"}}]}}, {"package":{"name":"platform/hardware/interfaces", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-11-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/hardware/interfaces/+/780a671da3d030368345155adc97e1687f8658de"], "severity":"High", "spl":"2026-11-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"255834689267382053440549860468519338361", "length":840}, "id":"ASB-A-269456968-117fc0ca", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/interfaces/+/780a671da3d030368345155adc97e1687f8658de", "target":{"file":"neuralnetworks/aidl/vts/functional/ValidateModel.cpp", "function":"validateModel"}}, {"deprecated":false, "digest":{"line_hashes":["40592511717342990389942058539945609306", "1215199241451092441693081628498869121", "129948529691575016124142609218851295746", "180984362077311833556099534600156618805", "196474455315920770780076363565407616005", "7710838437947647161968512562153547620", "289101019889694858839139463180580597518"], "threshold":0.9}, "id":"ASB-A-269456968-b75687c4", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/interfaces/+/780a671da3d030368345155adc97e1687f8658de", "target":{"file":"neuralnetworks/aidl/vts/functional/ValidateModel.cpp"}}]}}, {"package":{"name":"platform/packages/modules/NeuralNetworks", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-11-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/2cd68475b487672290c44e7adaed5a8f76ef1957"], "severity":"High", "spl":"2026-11-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["75187719208275870646090957093481890954", "340131414929134843437663854480429539680", "54001838752359329900919718142955712081", "285250356260115474433082804678168617461", "109424735767730076176734673742369407379", "39573811633329355338794009495144039177", "182830228131374686493677244538863397532", "98379926951023035715857893892377015667", "188637344271475611293398993770431629553", "229387678612352843714756599500284039861", "85359450305213975842027923137755667731", "220001508687791037264125116951112954330", "324735370805818494230502263013918886225", "101085154751499475628652996322645265504", "67375320668609752978282465410270834414", "120552197073837783068915436307065730213", "126287348359886453068673444172571704445", "50757414922992344976773212318036965487"], "threshold":0.9}, "id":"ASB-A-269456968-00e7ab1e", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/2cd68475b487672290c44e7adaed5a8f76ef1957", "target":{"file":"shim_and_sl/ShimConverter.cpp"}}, {"deprecated":false, "digest":{"function_hash":"117549551585405145896197857986194020165", "length":2040}, "id":"ASB-A-269456968-6540ee1d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/2cd68475b487672290c44e7adaed5a8f76ef1957", "target":{"file":"shim_and_sl/ShimConverter.cpp", "function":"isValid"}}]}}, {"package":{"name":"platform/hardware/interfaces", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-11-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/hardware/interfaces/+/332a204885a17a96969b6cfba494f2463db574e0"], "severity":"High", "spl":"2026-11-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["40592511717342990389942058539945609306", "1215199241451092441693081628498869121", "129948529691575016124142609218851295746", "180984362077311833556099534600156618805", "196474455315920770780076363565407616005", "7710838437947647161968512562153547620", "289101019889694858839139463180580597518"], "threshold":0.9}, "id":"ASB-A-269456968-78c5da37", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/interfaces/+/332a204885a17a96969b6cfba494f2463db574e0", "target":{"file":"neuralnetworks/aidl/vts/functional/ValidateModel.cpp"}}, {"deprecated":false, "digest":{"function_hash":"255834689267382053440549860468519338361", "length":840}, "id":"ASB-A-269456968-b86a92c0", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/interfaces/+/332a204885a17a96969b6cfba494f2463db574e0", "target":{"file":"neuralnetworks/aidl/vts/functional/ValidateModel.cpp", "function":"validateModel"}}]}}, {"package":{"name":"platform/packages/modules/NeuralNetworks", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-11-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/75e56c8ef4c213ccf72b12fbe076d125c5192865"], "severity":"High", "spl":"2026-11-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"117549551585405145896197857986194020165", "length":2040}, "id":"ASB-A-269456968-4b252925", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/75e56c8ef4c213ccf72b12fbe076d125c5192865", "target":{"file":"shim_and_sl/ShimConverter.cpp", "function":"isValid"}}, {"deprecated":false, "digest":{"line_hashes":["75187719208275870646090957093481890954", "340131414929134843437663854480429539680", "54001838752359329900919718142955712081", "285250356260115474433082804678168617461", "109424735767730076176734673742369407379", "39573811633329355338794009495144039177", "182830228131374686493677244538863397532", "98379926951023035715857893892377015667", "188637344271475611293398993770431629553", "229387678612352843714756599500284039861", "85359450305213975842027923137755667731", "220001508687791037264125116951112954330", "324735370805818494230502263013918886225", "101085154751499475628652996322645265504", "67375320668609752978282465410270834414", "120552197073837783068915436307065730213", "126287348359886453068673444172571704445", "50757414922992344976773212318036965487"], "threshold":0.9}, "id":"ASB-A-269456968-e973a787", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/75e56c8ef4c213ccf72b12fbe076d125c5192865", "target":{"file":"shim_and_sl/ShimConverter.cpp"}}]}}, {"package":{"name":"platform/hardware/interfaces", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-11-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/hardware/interfaces/+/98d133b6182eab38f6af5c56bf1f9a00687ea277"], "severity":"High", "spl":"2026-11-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["40592511717342990389942058539945609306", "1215199241451092441693081628498869121", "129948529691575016124142609218851295746", "180984362077311833556099534600156618805", "196474455315920770780076363565407616005", "7710838437947647161968512562153547620", "289101019889694858839139463180580597518"], "threshold":0.9}, "id":"ASB-A-269456968-4b814d83", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/interfaces/+/98d133b6182eab38f6af5c56bf1f9a00687ea277", "target":{"file":"neuralnetworks/aidl/vts/functional/ValidateModel.cpp"}}, {"deprecated":false, "digest":{"function_hash":"255834689267382053440549860468519338361", "length":840}, "id":"ASB-A-269456968-86dcdde1", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/interfaces/+/98d133b6182eab38f6af5c56bf1f9a00687ea277", "target":{"file":"neuralnetworks/aidl/vts/functional/ValidateModel.cpp", "function":"validateModel"}}]}}, {"package":{"name":"platform/packages/modules/NeuralNetworks", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-11-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/0be2d9a3abdc89d33e14b1fac965ce53b52b3f5a"], "severity":"High", "spl":"2026-11-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"117549551585405145896197857986194020165", "length":2040}, "id":"ASB-A-269456968-b591eb91", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/0be2d9a3abdc89d33e14b1fac965ce53b52b3f5a", "target":{"file":"shim_and_sl/ShimConverter.cpp", "function":"isValid"}}, {"deprecated":false, "digest":{"line_hashes":["75187719208275870646090957093481890954", "340131414929134843437663854480429539680", "54001838752359329900919718142955712081", "285250356260115474433082804678168617461", "109424735767730076176734673742369407379", "39573811633329355338794009495144039177", "182830228131374686493677244538863397532", "98379926951023035715857893892377015667", "188637344271475611293398993770431629553", "229387678612352843714756599500284039861", "85359450305213975842027923137755667731", "220001508687791037264125116951112954330", "324735370805818494230502263013918886225", "101085154751499475628652996322645265504", "67375320668609752978282465410270834414", "120552197073837783068915436307065730213", "126287348359886453068673444172571704445", "50757414922992344976773212318036965487"], "threshold":0.9}, "id":"ASB-A-269456968-f00ca319", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/0be2d9a3abdc89d33e14b1fac965ce53b52b3f5a", "target":{"file":"shim_and_sl/ShimConverter.cpp"}}]}}, {"package":{"name":"platform/hardware/interfaces", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-11-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/hardware/interfaces/+/15f2e6e195f8e674f7612eade4f0ac170ba0a896"], "severity":"High", "spl":"2026-11-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"255834689267382053440549860468519338361", "length":840}, "id":"ASB-A-269456968-c2885ffe", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/interfaces/+/15f2e6e195f8e674f7612eade4f0ac170ba0a896", "target":{"file":"neuralnetworks/aidl/vts/functional/ValidateModel.cpp", "function":"validateModel"}}, {"deprecated":false, "digest":{"line_hashes":["40592511717342990389942058539945609306", "1215199241451092441693081628498869121", "129948529691575016124142609218851295746", "180984362077311833556099534600156618805", "196474455315920770780076363565407616005", "7710838437947647161968512562153547620", "289101019889694858839139463180580597518"], "threshold":0.9}, "id":"ASB-A-269456968-f55d7d92", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/hardware/interfaces/+/15f2e6e195f8e674f7612eade4f0ac170ba0a896", "target":{"file":"neuralnetworks/aidl/vts/functional/ValidateModel.cpp"}}]}}, {"package":{"name":"platform/packages/modules/NeuralNetworks", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-11-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/3fc1c2b349b1cf6f20ccd017b8c18108237c150a"], "severity":"High", "spl":"2026-11-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["75187719208275870646090957093481890954", "340131414929134843437663854480429539680", "54001838752359329900919718142955712081", "285250356260115474433082804678168617461", "109424735767730076176734673742369407379", "39573811633329355338794009495144039177", "182830228131374686493677244538863397532", "98379926951023035715857893892377015667", "188637344271475611293398993770431629553", "229387678612352843714756599500284039861", "85359450305213975842027923137755667731", "220001508687791037264125116951112954330", "324735370805818494230502263013918886225", "101085154751499475628652996322645265504", "67375320668609752978282465410270834414", "120552197073837783068915436307065730213", "126287348359886453068673444172571704445", "50757414922992344976773212318036965487"], "threshold":0.9}, "id":"ASB-A-269456968-5ac3dbaf", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/3fc1c2b349b1cf6f20ccd017b8c18108237c150a", "target":{"file":"shim_and_sl/ShimConverter.cpp"}}, {"deprecated":false, "digest":{"function_hash":"117549551585405145896197857986194020165", "length":2040}, "id":"ASB-A-269456968-5bb6f55c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/3fc1c2b349b1cf6f20ccd017b8c18108237c150a", "target":{"file":"shim_and_sl/ShimConverter.cpp", "function":"isValid"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}