{"id":"ASB-A-459460951", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-10T15:43:18.983809180Z", "aliases":["CVE-2026-58874", "A-459460951"], "details":"In multiple functions of SmsController.java, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/c6e940d710fbd4383f2e999f4d1a2234c0ae11dc"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["314491743165801948123262950922210516532", "281711988256244874554787287552216749399", "83841026515189704200015352038518875857", "134548027252990306907230439262372317069", "242557198168100842837376928432032907867", "212198471106597362628783621170278581071", "116741174541360479486316790328088464386", "273368188948173911464489148214274841410", "165752730715071622491233163929213851290"], "threshold":0.9}, "id":"ASB-A-459460951-1aea3df8", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/c6e940d710fbd4383f2e999f4d1a2234c0ae11dc", "target":{"file":"telephony/common/com/android/internal/telephony/TelephonyPermissions.java"}}, {"deprecated":false, "digest":{"function_hash":"141782428824802642949931918294330175748", "length":608}, "id":"ASB-A-459460951-be735a98", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/c6e940d710fbd4383f2e999f4d1a2234c0ae11dc", "target":{"file":"telephony/common/com/android/internal/telephony/TelephonyPermissions.java", "function":"checkSubscriptionAssociatedWithUser"}}]}}, {"package":{"name":"platform/frameworks/opt/telephony", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/6cffd2ed55767990357cf11ab54718954ac6d961"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"49785933579441875669908815356361611936", "length":719}, "id":"ASB-A-459460951-0b86aebe", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/6cffd2ed55767990357cf11ab54718954ac6d961", "target":{"file":"src/java/com/android/internal/telephony/SmsController.java", "function":"sendStoredText"}}, {"deprecated":false, "digest":{"function_hash":"234495463127686722443156479948848580485", "length":747}, "id":"ASB-A-459460951-98900e6c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/6cffd2ed55767990357cf11ab54718954ac6d961", "target":{"file":"src/java/com/android/internal/telephony/SmsController.java", "function":"sendStoredMultipartText"}}, {"deprecated":false, "digest":{"line_hashes":["98043236030772146082793337236296238717", "108438292240198667044992932427419031023", "12005593342205208870274374818040482355", "325710822266304529067751621639196001352"], "threshold":0.9}, "id":"ASB-A-459460951-d2c6637d", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/6cffd2ed55767990357cf11ab54718954ac6d961", "target":{"file":"src/java/com/android/internal/telephony/IccSmsInterfaceManager.java"}}, {"deprecated":false, "digest":{"line_hashes":["90228688156430979903343446701831398516", "264631826315680333814687486510804304030", "87613765760672379253449611814982469956", "317017134271730343835728322008917066771", "272125616025489698398826578524128504483", "110248927711739923489248316846811819917", "18635445160070284091469821276910560372", "143951072537177597762714706957505342215", "111772090368289363102083054791839693323", "18130604361217788038250834497169969686", "36774268761721323831576035399644438143", "243448042227188207368857343813622762477", "205711528463042389763454601506716539833"], "threshold":0.9}, "id":"ASB-A-459460951-d4015021", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/6cffd2ed55767990357cf11ab54718954ac6d961", "target":{"file":"src/java/com/android/internal/telephony/SmsController.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-09-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/317601a2835578dd049383101ce380f27e34ef41"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"141782428824802642949931918294330175748", "length":608}, "id":"ASB-A-459460951-29c7ba68", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/317601a2835578dd049383101ce380f27e34ef41", "target":{"file":"telephony/common/com/android/internal/telephony/TelephonyPermissions.java", "function":"checkSubscriptionAssociatedWithUser"}}, {"deprecated":false, "digest":{"line_hashes":["314491743165801948123262950922210516532", "281711988256244874554787287552216749399", "83841026515189704200015352038518875857", "134548027252990306907230439262372317069", "242557198168100842837376928432032907867", "212198471106597362628783621170278581071", "116741174541360479486316790328088464386", "273368188948173911464489148214274841410", "165752730715071622491233163929213851290"], "threshold":0.9}, "id":"ASB-A-459460951-8b856d65", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/317601a2835578dd049383101ce380f27e34ef41", "target":{"file":"telephony/common/com/android/internal/telephony/TelephonyPermissions.java"}}]}}, {"package":{"name":"platform/frameworks/opt/telephony", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-09-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/f03821d51b64e0eac6870f8565694143dadad2af"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"237115520426249656102696369553982150623", "length":632}, "id":"ASB-A-459460951-124e3c26", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/f03821d51b64e0eac6870f8565694143dadad2af", "target":{"file":"src/java/com/android/internal/telephony/SmsController.java", "function":"sendStoredText"}}, {"deprecated":false, "digest":{"line_hashes":["74775786963757892677466474442989367079", "73502138666139269991024399683830686201", "279994131248835305918298891509137584136", "317017134271730343835728322008917066771", "86797430969411904796541856642897395742", "198739071019880017494062073610405901429", "96002864560410248236344145552632222126", "39330019612956078569066622781821208727", "260849834579265409309202059693066502580", "207227479982182757967255081291369175668", "36774268761721323831576035399644438143", "243448042227188207368857343813622762477", "205711528463042389763454601506716539833"], "threshold":0.9}, "id":"ASB-A-459460951-2bca0fb2", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/f03821d51b64e0eac6870f8565694143dadad2af", "target":{"file":"src/java/com/android/internal/telephony/SmsController.java"}}, {"deprecated":false, "digest":{"line_hashes":["98043236030772146082793337236296238717", "108438292240198667044992932427419031023", "12005593342205208870274374818040482355", "325710822266304529067751621639196001352"], "threshold":0.9}, "id":"ASB-A-459460951-38e0e34c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/f03821d51b64e0eac6870f8565694143dadad2af", "target":{"file":"src/java/com/android/internal/telephony/IccSmsInterfaceManager.java"}}, {"deprecated":false, "digest":{"function_hash":"209485642538337701783658441792947791822", "length":660}, "id":"ASB-A-459460951-98d42f1c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/f03821d51b64e0eac6870f8565694143dadad2af", "target":{"file":"src/java/com/android/internal/telephony/SmsController.java", "function":"sendStoredMultipartText"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/1aae4267206d1a08d30158bfce99a766550f1afd"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["314491743165801948123262950922210516532", "281711988256244874554787287552216749399", "83841026515189704200015352038518875857", "134548027252990306907230439262372317069", "242557198168100842837376928432032907867", "212198471106597362628783621170278581071", "116741174541360479486316790328088464386", "273368188948173911464489148214274841410", "165752730715071622491233163929213851290"], "threshold":0.9}, "id":"ASB-A-459460951-231b0f38", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1aae4267206d1a08d30158bfce99a766550f1afd", "target":{"file":"telephony/common/com/android/internal/telephony/TelephonyPermissions.java"}}, {"deprecated":false, "digest":{"function_hash":"141782428824802642949931918294330175748", "length":608}, "id":"ASB-A-459460951-9c092e05", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1aae4267206d1a08d30158bfce99a766550f1afd", "target":{"file":"telephony/common/com/android/internal/telephony/TelephonyPermissions.java", "function":"checkSubscriptionAssociatedWithUser"}}]}}, {"package":{"name":"platform/frameworks/opt/telephony", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/92143d3e5ee352208511dff16728c16b0ec299bb"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["74775786963757892677466474442989367079", "73502138666139269991024399683830686201", "279994131248835305918298891509137584136", "317017134271730343835728322008917066771", "297712991158285410917672672985501731946", "27453540411357979666228332925531163072", "101930701347659089037017261600480075804", "215121875714410693865399204354840310654", "26898975272359097872418799516659272247", "45630850879745698146895133740609720992", "86797430969411904796541856642897395742", "110248927711739923489248316846811819917", "189261087086982396803033661412760932935", "307270290257897599719812123790660509009", "116390827937237596379501881976627447295", "270008887797449153419812292017403152621", "27140489876626401156469873938072959187", "79494701042987115461538829588879337501", "39330019612956078569066622781821208727", "111772090368289363102083054791839693323", "88205013806212371733316656435845009925", "36774268761721323831576035399644438143", "243448042227188207368857343813622762477", "205711528463042389763454601506716539833"], "threshold":0.9}, "id":"ASB-A-459460951-45c819e7", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/92143d3e5ee352208511dff16728c16b0ec299bb", "target":{"file":"src/java/com/android/internal/telephony/SmsController.java"}}, {"deprecated":false, "digest":{"line_hashes":["98043236030772146082793337236296238717", "108438292240198667044992932427419031023", "12005593342205208870274374818040482355", "325710822266304529067751621639196001352"], "threshold":0.9}, "id":"ASB-A-459460951-4d8fd2c5", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/92143d3e5ee352208511dff16728c16b0ec299bb", "target":{"file":"src/java/com/android/internal/telephony/IccSmsInterfaceManager.java"}}, {"deprecated":false, "digest":{"function_hash":"150513958370728880399310669791159728820", "length":717}, "id":"ASB-A-459460951-bae7367e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/92143d3e5ee352208511dff16728c16b0ec299bb", "target":{"file":"src/java/com/android/internal/telephony/SmsController.java", "function":"sendStoredMultipartText"}}, {"deprecated":false, "digest":{"function_hash":"209947485150884182026183962848039118935", "length":689}, "id":"ASB-A-459460951-cc24438e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/92143d3e5ee352208511dff16728c16b0ec299bb", "target":{"file":"src/java/com/android/internal/telephony/SmsController.java", "function":"sendStoredText"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/3913c258e5da85b42cd60db49f5226c10eebcce2"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["314491743165801948123262950922210516532", "281711988256244874554787287552216749399", "83841026515189704200015352038518875857", "134548027252990306907230439262372317069", "242557198168100842837376928432032907867", "212198471106597362628783621170278581071", "116741174541360479486316790328088464386", "273368188948173911464489148214274841410", "165752730715071622491233163929213851290"], "threshold":0.9}, "id":"ASB-A-459460951-66f6b188", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/3913c258e5da85b42cd60db49f5226c10eebcce2", "target":{"file":"telephony/common/com/android/internal/telephony/TelephonyPermissions.java"}}, {"deprecated":false, "digest":{"function_hash":"141782428824802642949931918294330175748", "length":608}, "id":"ASB-A-459460951-82edb078", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/3913c258e5da85b42cd60db49f5226c10eebcce2", "target":{"file":"telephony/common/com/android/internal/telephony/TelephonyPermissions.java", "function":"checkSubscriptionAssociatedWithUser"}}]}}, {"package":{"name":"platform/frameworks/opt/telephony", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/cbecd57d7992d6d8ad40ddee7cc8a45bac88b35d"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["74775786963757892677466474442989367079", "73502138666139269991024399683830686201", "279994131248835305918298891509137584136", "317017134271730343835728322008917066771", "272125616025489698398826578524128504483", "110248927711739923489248316846811819917", "18635445160070284091469821276910560372", "143951072537177597762714706957505342215", "111772090368289363102083054791839693323", "18130604361217788038250834497169969686", "36774268761721323831576035399644438143", "243448042227188207368857343813622762477", "205711528463042389763454601506716539833"], "threshold":0.9}, "id":"ASB-A-459460951-3714dbd2", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/cbecd57d7992d6d8ad40ddee7cc8a45bac88b35d", "target":{"file":"src/java/com/android/internal/telephony/SmsController.java"}}, {"deprecated":false, "digest":{"function_hash":"234495463127686722443156479948848580485", "length":747}, "id":"ASB-A-459460951-603a3716", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/cbecd57d7992d6d8ad40ddee7cc8a45bac88b35d", "target":{"file":"src/java/com/android/internal/telephony/SmsController.java", "function":"sendStoredMultipartText"}}, {"deprecated":false, "digest":{"function_hash":"49785933579441875669908815356361611936", "length":719}, "id":"ASB-A-459460951-aa948206", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/cbecd57d7992d6d8ad40ddee7cc8a45bac88b35d", "target":{"file":"src/java/com/android/internal/telephony/SmsController.java", "function":"sendStoredText"}}, {"deprecated":false, "digest":{"line_hashes":["98043236030772146082793337236296238717", "108438292240198667044992932427419031023", "12005593342205208870274374818040482355", "325710822266304529067751621639196001352"], "threshold":0.9}, "id":"ASB-A-459460951-fad03072", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/cbecd57d7992d6d8ad40ddee7cc8a45bac88b35d", "target":{"file":"src/java/com/android/internal/telephony/IccSmsInterfaceManager.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-09-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/4b47face486ac4955bbba6b9333a5ce2266572aa"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["314491743165801948123262950922210516532", "252598080043004827681757014611365046554", "217625807822754269569859293540316366295", "159776500266863526666748962523335670120", "301540864122162222560784990278895136549", "116741174541360479486316790328088464386", "273368188948173911464489148214274841410", "165752730715071622491233163929213851290"], "threshold":0.9}, "id":"ASB-A-459460951-978aa743", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/4b47face486ac4955bbba6b9333a5ce2266572aa", "target":{"file":"telephony/common/com/android/internal/telephony/TelephonyPermissions.java"}}, {"deprecated":false, "digest":{"function_hash":"118426378044520048888982666814326048856", "length":586}, "id":"ASB-A-459460951-9c469f7b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/4b47face486ac4955bbba6b9333a5ce2266572aa", "target":{"file":"telephony/common/com/android/internal/telephony/TelephonyPermissions.java", "function":"checkSubscriptionAssociatedWithUser"}}]}}, {"package":{"name":"platform/frameworks/opt/telephony", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-09-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/534b628339a3e392dd9e3c7492d9f95bdef0f634"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"237115520426249656102696369553982150623", "length":632}, "id":"ASB-A-459460951-25a688a4", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/534b628339a3e392dd9e3c7492d9f95bdef0f634", "target":{"file":"src/java/com/android/internal/telephony/SmsController.java", "function":"sendStoredText"}}, {"deprecated":false, "digest":{"function_hash":"209485642538337701783658441792947791822", "length":660}, "id":"ASB-A-459460951-47b79a01", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/534b628339a3e392dd9e3c7492d9f95bdef0f634", "target":{"file":"src/java/com/android/internal/telephony/SmsController.java", "function":"sendStoredMultipartText"}}, {"deprecated":false, "digest":{"line_hashes":["90228688156430979903343446701831398516", "264631826315680333814687486510804304030", "87613765760672379253449611814982469956", "317017134271730343835728322008917066771", "127738613636760661849125486534341292321", "46497981190808472824079839750577843401", "231017406722351973647466605896912637162", "87802942734101893942532258000664230763", "86797430969411904796541856642897395742", "198739071019880017494062073610405901429", "96002864560410248236344145552632222126", "39330019612956078569066622781821208727", "260849834579265409309202059693066502580", "207227479982182757967255081291369175668", "36774268761721323831576035399644438143", "243448042227188207368857343813622762477", "11326197185867692115674269153010869525"], "threshold":0.9}, "id":"ASB-A-459460951-87c12ffe", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/534b628339a3e392dd9e3c7492d9f95bdef0f634", "target":{"file":"src/java/com/android/internal/telephony/SmsController.java"}}, {"deprecated":false, "digest":{"line_hashes":["98043236030772146082793337236296238717", "108438292240198667044992932427419031023", "12005593342205208870274374818040482355", "325710822266304529067751621639196001352"], "threshold":0.9}, "id":"ASB-A-459460951-be6ca932", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/534b628339a3e392dd9e3c7492d9f95bdef0f634", "target":{"file":"src/java/com/android/internal/telephony/IccSmsInterfaceManager.java"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}