{"id":"ASB-A-429417238", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-05T16:32:28.703711716Z", "aliases":["CVE-2026-58817", "A-429417238"], "details":"In parseKnownActivityEmbeddingCerts of ParsingUtils.java, there is a possible permanent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/9b87ad723646792a57b05e28931a788f372a2ec5"], "severity":"High", "spl":"2026-11-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["306136529359641075513368964209708263678", "123507770211255993651813289831972339760", "3655616931828042997627322190628965527", "332909460807459735099002142028160808396", "304227493300646502449332491813484550862", "245570317473973978117202907087829441441", "196763123319378797482176461983037514634", "256312972263055212677532211445382668670", "337253228926897386829257334302070166490", "300890432004437832092040560689949481155", "50963977145015276314728445967738950406", "122669960936708869006114982608557048832", "328763088250435422836999130712035413696", "211739489076725607812476063490105667765", "141638703454890326429067496788754470760", "199966837548834435407804437204200762881", "261490629404462201185508042179370375761", "16404223645792029503600092442635320744", "18278861375283832920611302783856081532", "171599445485654572934562279883326190152", "46015860123260994606990546628713483162", "199419217534886744147096603441495711791", "5490366294424843882188422480510760522", "159907339341954119328867857229328390729", "266379167305941128299752562200156997543", "163939404589066666541419238162041259706", "190893879977609539443913433348050829268", "88317630091678782345700262663917075208", "23692016544369406808673701492767289018", "196348174667685681635848625785139481334", "53350124709609136729466963933136363528", "42243062627570949681318621884620636737", "125485040162517445626606605765657966748", "113016388921423937688974813141830670998"], "threshold":0.9}, "id":"ASB-A-429417238-23b4df75", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/9b87ad723646792a57b05e28931a788f372a2ec5", "target":{"file":"core/java/com/android/internal/pm/pkg/parsing/ParsingUtils.java"}}, {"deprecated":false, "digest":{"function_hash":"247746600246818536682223738846478141763", "length":1022}, "id":"ASB-A-429417238-4f662d10", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/9b87ad723646792a57b05e28931a788f372a2ec5", "target":{"file":"core/java/com/android/internal/pm/pkg/parsing/ParsingUtils.java", "function":"parseKnownActivityEmbeddingCerts"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-11-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/0c38a57964f3f56389c4f2fefc7e8f037ab8303b"], "severity":"High", "spl":"2026-11-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["306136529359641075513368964209708263678", "123507770211255993651813289831972339760", "3655616931828042997627322190628965527", "332909460807459735099002142028160808396", "304227493300646502449332491813484550862", "245570317473973978117202907087829441441", "196763123319378797482176461983037514634", "256312972263055212677532211445382668670", "337253228926897386829257334302070166490", "300890432004437832092040560689949481155", "50963977145015276314728445967738950406", "122669960936708869006114982608557048832", "328763088250435422836999130712035413696", "211739489076725607812476063490105667765", "141638703454890326429067496788754470760", "199966837548834435407804437204200762881", "261490629404462201185508042179370375761", "16404223645792029503600092442635320744", "18278861375283832920611302783856081532", "171599445485654572934562279883326190152", "46015860123260994606990546628713483162", "199419217534886744147096603441495711791", "5490366294424843882188422480510760522", "159907339341954119328867857229328390729", "266379167305941128299752562200156997543", "163939404589066666541419238162041259706", "190893879977609539443913433348050829268", "88317630091678782345700262663917075208", "23692016544369406808673701492767289018", "196348174667685681635848625785139481334", "53350124709609136729466963933136363528", "42243062627570949681318621884620636737", "125485040162517445626606605765657966748", "113016388921423937688974813141830670998"], "threshold":0.9}, "id":"ASB-A-429417238-393f4d37", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/0c38a57964f3f56389c4f2fefc7e8f037ab8303b", "target":{"file":"core/java/com/android/internal/pm/pkg/parsing/ParsingUtils.java"}}, {"deprecated":false, "digest":{"function_hash":"247746600246818536682223738846478141763", "length":1022}, "id":"ASB-A-429417238-bc2e1dea", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/0c38a57964f3f56389c4f2fefc7e8f037ab8303b", "target":{"file":"core/java/com/android/internal/pm/pkg/parsing/ParsingUtils.java", "function":"parseKnownActivityEmbeddingCerts"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-11-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/dbb4c3759121b1dbdd4ee9eb6cfe09b50a1b2f11"], "severity":"High", "spl":"2026-11-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["306136529359641075513368964209708263678", "123507770211255993651813289831972339760", "3655616931828042997627322190628965527", "332909460807459735099002142028160808396", "304227493300646502449332491813484550862", "245570317473973978117202907087829441441", "196763123319378797482176461983037514634", "256312972263055212677532211445382668670", "337253228926897386829257334302070166490", "300890432004437832092040560689949481155", "50963977145015276314728445967738950406", "122669960936708869006114982608557048832", "328763088250435422836999130712035413696", "211739489076725607812476063490105667765", "141638703454890326429067496788754470760", "199966837548834435407804437204200762881", "261490629404462201185508042179370375761", "16404223645792029503600092442635320744", "18278861375283832920611302783856081532", "171599445485654572934562279883326190152", "46015860123260994606990546628713483162", "199419217534886744147096603441495711791", "5490366294424843882188422480510760522", "159907339341954119328867857229328390729", "266379167305941128299752562200156997543", "163939404589066666541419238162041259706", "190893879977609539443913433348050829268", "88317630091678782345700262663917075208", "23692016544369406808673701492767289018", "196348174667685681635848625785139481334", "53350124709609136729466963933136363528", "42243062627570949681318621884620636737", "125485040162517445626606605765657966748", "113016388921423937688974813141830670998"], "threshold":0.9}, "id":"ASB-A-429417238-962a97ee", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/dbb4c3759121b1dbdd4ee9eb6cfe09b50a1b2f11", "target":{"file":"core/java/com/android/internal/pm/pkg/parsing/ParsingUtils.java"}}, {"deprecated":false, "digest":{"function_hash":"247746600246818536682223738846478141763", "length":1022}, "id":"ASB-A-429417238-afa4cdc8", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/dbb4c3759121b1dbdd4ee9eb6cfe09b50a1b2f11", "target":{"file":"core/java/com/android/internal/pm/pkg/parsing/ParsingUtils.java", "function":"parseKnownActivityEmbeddingCerts"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-11-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/58e6711dd5df6aa4d6da7f1e5de2f75cf10475f0"], "severity":"High", "spl":"2026-11-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["306136529359641075513368964209708263678", "123507770211255993651813289831972339760", "3655616931828042997627322190628965527", "332909460807459735099002142028160808396", "304227493300646502449332491813484550862", "245570317473973978117202907087829441441", "196763123319378797482176461983037514634", "256312972263055212677532211445382668670", "337253228926897386829257334302070166490", "300890432004437832092040560689949481155", "50963977145015276314728445967738950406", "122669960936708869006114982608557048832", "328763088250435422836999130712035413696", "211739489076725607812476063490105667765", "141638703454890326429067496788754470760", "199966837548834435407804437204200762881", "261490629404462201185508042179370375761", "16404223645792029503600092442635320744", "18278861375283832920611302783856081532", "171599445485654572934562279883326190152", "46015860123260994606990546628713483162", "199419217534886744147096603441495711791", "5490366294424843882188422480510760522", "159907339341954119328867857229328390729", "266379167305941128299752562200156997543", "163939404589066666541419238162041259706", "190893879977609539443913433348050829268", "88317630091678782345700262663917075208", "23692016544369406808673701492767289018", "196348174667685681635848625785139481334", "53350124709609136729466963933136363528", "42243062627570949681318621884620636737", "125485040162517445626606605765657966748", "113016388921423937688974813141830670998"], "threshold":0.9}, "id":"ASB-A-429417238-56522b5c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/58e6711dd5df6aa4d6da7f1e5de2f75cf10475f0", "target":{"file":"core/java/com/android/internal/pm/pkg/parsing/ParsingUtils.java"}}, {"deprecated":false, "digest":{"function_hash":"247746600246818536682223738846478141763", "length":1022}, "id":"ASB-A-429417238-e4ccea30", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/58e6711dd5df6aa4d6da7f1e5de2f75cf10475f0", "target":{"file":"core/java/com/android/internal/pm/pkg/parsing/ParsingUtils.java", "function":"parseKnownActivityEmbeddingCerts"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-11-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/5c47d86bbf21b44eced5551da433934109f10cd2"], "severity":"High", "spl":"2026-11-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"247746600246818536682223738846478141763", "length":1022}, "id":"ASB-A-429417238-ba802e3b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/5c47d86bbf21b44eced5551da433934109f10cd2", "target":{"file":"core/java/com/android/internal/pm/pkg/parsing/ParsingUtils.java", "function":"parseKnownActivityEmbeddingCerts"}}, {"deprecated":false, "digest":{"line_hashes":["306136529359641075513368964209708263678", "123507770211255993651813289831972339760", "3655616931828042997627322190628965527", "332909460807459735099002142028160808396", "304227493300646502449332491813484550862", "245570317473973978117202907087829441441", "196763123319378797482176461983037514634", "256312972263055212677532211445382668670", "337253228926897386829257334302070166490", "300890432004437832092040560689949481155", "50963977145015276314728445967738950406", "122669960936708869006114982608557048832", "328763088250435422836999130712035413696", "211739489076725607812476063490105667765", "141638703454890326429067496788754470760", "199966837548834435407804437204200762881", "261490629404462201185508042179370375761", "16404223645792029503600092442635320744", "18278861375283832920611302783856081532", "171599445485654572934562279883326190152", "46015860123260994606990546628713483162", "199419217534886744147096603441495711791", "5490366294424843882188422480510760522", "159907339341954119328867857229328390729", "266379167305941128299752562200156997543", "163939404589066666541419238162041259706", "190893879977609539443913433348050829268", "88317630091678782345700262663917075208", "23692016544369406808673701492767289018", "196348174667685681635848625785139481334", "53350124709609136729466963933136363528", "42243062627570949681318621884620636737", "125485040162517445626606605765657966748", "113016388921423937688974813141830670998"], "threshold":0.9}, "id":"ASB-A-429417238-fa62e0d8", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/5c47d86bbf21b44eced5551da433934109f10cd2", "target":{"file":"core/java/com/android/internal/pm/pkg/parsing/ParsingUtils.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-11-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/eacbf7119d279cebd4ef3334d33bcbdb647fdbc3"], "severity":"High", "spl":"2026-11-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"247746600246818536682223738846478141763", "length":1022}, "id":"ASB-A-429417238-6cd1667c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/eacbf7119d279cebd4ef3334d33bcbdb647fdbc3", "target":{"file":"services/core/java/com/android/server/pm/pkg/parsing/ParsingUtils.java", "function":"parseKnownActivityEmbeddingCerts"}}, {"deprecated":false, "digest":{"line_hashes":["77168529489992102237453041860761451085", "123507770211255993651813289831972339760", "3655616931828042997627322190628965527", "332909460807459735099002142028160808396", "304227493300646502449332491813484550862", "245570317473973978117202907087829441441", "196763123319378797482176461983037514634", "256312972263055212677532211445382668670", "337253228926897386829257334302070166490", "300890432004437832092040560689949481155", "50963977145015276314728445967738950406", "122669960936708869006114982608557048832", "328763088250435422836999130712035413696", "211739489076725607812476063490105667765", "141638703454890326429067496788754470760", "199966837548834435407804437204200762881", "261490629404462201185508042179370375761", "16404223645792029503600092442635320744", "18278861375283832920611302783856081532", "171599445485654572934562279883326190152", "46015860123260994606990546628713483162", "199419217534886744147096603441495711791", "5490366294424843882188422480510760522", "159907339341954119328867857229328390729", "266379167305941128299752562200156997543", "163939404589066666541419238162041259706", "190893879977609539443913433348050829268", "88317630091678782345700262663917075208", "23692016544369406808673701492767289018", "196348174667685681635848625785139481334", "53350124709609136729466963933136363528", "42243062627570949681318621884620636737", "125485040162517445626606605765657966748", "113016388921423937688974813141830670998"], "threshold":0.9}, "id":"ASB-A-429417238-d5d741cb", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/eacbf7119d279cebd4ef3334d33bcbdb647fdbc3", "target":{"file":"services/core/java/com/android/server/pm/pkg/parsing/ParsingUtils.java"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}