{"id":"ASB-A-463363325", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-02T16:38:00.081625681Z", "aliases":["CVE-2026-58821", "A-463363325"], "details":"In multiple functions of SearchRequestDatabaseUtil.java, there is a possible way to access protected data due to SQL injection. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/providers/MediaProvider", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/269a581419a7b43bdfeae42aac0058041b2f30d7"], "severity":"High", "spl":"2026-11-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"189740579461115909734292135186021905372", "length":1276}, "id":"ASB-A-463363325-3b89a352", "match_only_versions":["17-qpr2-next"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/269a581419a7b43bdfeae42aac0058041b2f30d7", "target":{"file":"src/com/android/providers/media/photopicker/v2/sqlite/SearchRequestDatabaseUtil.java", "function":"addSearchRequestIDWhereClause"}}, {"deprecated":false, "digest":{"function_hash":"210950047188613910655174200572613816358", "length":212}, "id":"ASB-A-463363325-3bd5ac8b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/269a581419a7b43bdfeae42aac0058041b2f30d7", "target":{"file":"src/com/android/providers/media/photopicker/v2/sqlite/SearchRequestDatabaseUtil.java", "function":"addWhereClause"}}, {"deprecated":false, "digest":{"line_hashes":["76916365870034971198637684103886033135", "128922828884659408288050209043016768915", "217931323205289835552310038977271664885", "318790452508622618792570407031190907601", "14677126980517322556569812481696060860", "255722069000824933372395904868908598545", "171048033038404624932238060707318581954", "69378524261551302396044391961654699783", "71041784633586202127679008814836717912", "276527407471848080530730929749736260652", "319605298363515758662532957772964769170", "128205699815556284236109166532913862814", "339695431892243403354181387792530575991", "279998751066028923428935587419996716192", "23269302097002900105730806992712367180", "135395322301929792626159590884046151442", "149812537929952261424079010877492257397", "293285477897649419218350364825450368496", "212603311783952654257431848135963393613", "317485110783021424248366720322106516291", "72158728852810912070998669554112173300", "38287029669499789899132716117640744016", "156553187957709353709624213439640777468", "292835552961734979416639329203702663037", "213235143565608166079200140108585600166", "66183904103364599588108713597162120033", "147391520002679308898086101312389191988", "60617770341470730220877491565867070372", "63032668325265647257214524225500145135", "45691847782844977569278292612179001240", "90835769712886224221685446776163440252", "263785966325387192560124370737423349310", "90756788071140159586175171957544242750", "303095600871006343587761685968103760864", "63182533702892027775670012053469867290", "221900061160826178880277175874228575526", "128954636333821733601391535804327188413", "80749090080275805368426102220028670129", "122374546446950884044484149631946168737", "293475058886872495219852208599124513913", "332238100481420310684068975939204017627", "227074683579606258644008935206797877590"], "threshold":0.9}, "id":"ASB-A-463363325-7eca31bf", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/269a581419a7b43bdfeae42aac0058041b2f30d7", "target":{"file":"src/com/android/providers/media/photopicker/v2/sqlite/SearchRequestDatabaseUtil.java"}}, {"deprecated":false, "digest":{"function_hash":"162760856670847349653271982318324196451", "length":933}, "id":"ASB-A-463363325-c062488a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/269a581419a7b43bdfeae42aac0058041b2f30d7", "target":{"file":"src/com/android/providers/media/photopicker/v2/sqlite/SearchRequestDatabaseUtil.java", "function":"getSearchRequestID"}}]}}, {"package":{"name":"platform/packages/providers/MediaProvider", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-11-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/db4125270edb9ad61d44c5084f7bba5341daa9c0"], "severity":"High", "spl":"2026-11-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"162760856670847349653271982318324196451", "length":933}, "id":"ASB-A-463363325-37930a04", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/db4125270edb9ad61d44c5084f7bba5341daa9c0", "target":{"file":"src/com/android/providers/media/photopicker/v2/sqlite/SearchRequestDatabaseUtil.java", "function":"getSearchRequestID"}}, {"deprecated":false, "digest":{"line_hashes":["76916365870034971198637684103886033135", "128922828884659408288050209043016768915", "217931323205289835552310038977271664885", "318790452508622618792570407031190907601", "14677126980517322556569812481696060860", "255722069000824933372395904868908598545", "171048033038404624932238060707318581954", "69378524261551302396044391961654699783", "71041784633586202127679008814836717912", "276527407471848080530730929749736260652", "319605298363515758662532957772964769170", "128205699815556284236109166532913862814", "125225221194248178477065318859072732940", "160468545528526899065973188028656901371", "26556923393991993163266964239683102825", "94265117873179881763208459735231309873", "149812537929952261424079010877492257397", "293285477897649419218350364825450368496", "212603311783952654257431848135963393613", "317485110783021424248366720322106516291", "72158728852810912070998669554112173300", "38287029669499789899132716117640744016", "156553187957709353709624213439640777468", "292835552961734979416639329203702663037", "213235143565608166079200140108585600166", "66183904103364599588108713597162120033", "147391520002679308898086101312389191988", "60617770341470730220877491565867070372", "63032668325265647257214524225500145135", "45691847782844977569278292612179001240", "90835769712886224221685446776163440252", "263785966325387192560124370737423349310", "90756788071140159586175171957544242750", "303095600871006343587761685968103760864", "63182533702892027775670012053469867290", "221900061160826178880277175874228575526", "128954636333821733601391535804327188413", "80749090080275805368426102220028670129", "122374546446950884044484149631946168737", "293475058886872495219852208599124513913", "332238100481420310684068975939204017627", "227074683579606258644008935206797877590"], "threshold":0.9}, "id":"ASB-A-463363325-6d032ee1", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/db4125270edb9ad61d44c5084f7bba5341daa9c0", "target":{"file":"src/com/android/providers/media/photopicker/v2/sqlite/SearchRequestDatabaseUtil.java"}}, {"deprecated":false, "digest":{"function_hash":"210950047188613910655174200572613816358", "length":212}, "id":"ASB-A-463363325-8b5f3891", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/db4125270edb9ad61d44c5084f7bba5341daa9c0", "target":{"file":"src/com/android/providers/media/photopicker/v2/sqlite/SearchRequestDatabaseUtil.java", "function":"addWhereClause"}}, {"deprecated":false, "digest":{"function_hash":"171231985333939436695006900228040759553", "length":1266}, "id":"ASB-A-463363325-c80346ff", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/db4125270edb9ad61d44c5084f7bba5341daa9c0", "target":{"file":"src/com/android/providers/media/photopicker/v2/sqlite/SearchRequestDatabaseUtil.java", "function":"addSearchRequestIDWhereClause"}}]}}, {"package":{"name":"platform/packages/providers/MediaProvider", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-11-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/f0b4f4bcd7d16f72e92e2c2f8545dc76030baf62"], "severity":"High", "spl":"2026-11-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["76916365870034971198637684103886033135", "128922828884659408288050209043016768915", "217931323205289835552310038977271664885", "318790452508622618792570407031190907601", "14677126980517322556569812481696060860", "255722069000824933372395904868908598545", "171048033038404624932238060707318581954", "69378524261551302396044391961654699783", "71041784633586202127679008814836717912", "276527407471848080530730929749736260652", "319605298363515758662532957772964769170", "128205699815556284236109166532913862814", "125225221194248178477065318859072732940", "160468545528526899065973188028656901371", "26556923393991993163266964239683102825", "94265117873179881763208459735231309873", "149812537929952261424079010877492257397", "293285477897649419218350364825450368496", "212603311783952654257431848135963393613", "317485110783021424248366720322106516291", "72158728852810912070998669554112173300", "38287029669499789899132716117640744016", "156553187957709353709624213439640777468", "292835552961734979416639329203702663037", "213235143565608166079200140108585600166", "66183904103364599588108713597162120033", "147391520002679308898086101312389191988", "60617770341470730220877491565867070372", "63032668325265647257214524225500145135", "45691847782844977569278292612179001240", "90835769712886224221685446776163440252", "263785966325387192560124370737423349310", "90756788071140159586175171957544242750", "303095600871006343587761685968103760864", "63182533702892027775670012053469867290", "221900061160826178880277175874228575526", "128954636333821733601391535804327188413", "80749090080275805368426102220028670129", "122374546446950884044484149631946168737", "293475058886872495219852208599124513913", "332238100481420310684068975939204017627", "227074683579606258644008935206797877590"], "threshold":0.9}, "id":"ASB-A-463363325-3ab2dd09", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/f0b4f4bcd7d16f72e92e2c2f8545dc76030baf62", "target":{"file":"src/com/android/providers/media/photopicker/v2/sqlite/SearchRequestDatabaseUtil.java"}}, {"deprecated":false, "digest":{"function_hash":"171231985333939436695006900228040759553", "length":1266}, "id":"ASB-A-463363325-6a800942", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/f0b4f4bcd7d16f72e92e2c2f8545dc76030baf62", "target":{"file":"src/com/android/providers/media/photopicker/v2/sqlite/SearchRequestDatabaseUtil.java", "function":"addSearchRequestIDWhereClause"}}, {"deprecated":false, "digest":{"function_hash":"162760856670847349653271982318324196451", "length":933}, "id":"ASB-A-463363325-c7218d83", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/f0b4f4bcd7d16f72e92e2c2f8545dc76030baf62", "target":{"file":"src/com/android/providers/media/photopicker/v2/sqlite/SearchRequestDatabaseUtil.java", "function":"getSearchRequestID"}}, {"deprecated":false, "digest":{"function_hash":"210950047188613910655174200572613816358", "length":212}, "id":"ASB-A-463363325-def0c796", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/f0b4f4bcd7d16f72e92e2c2f8545dc76030baf62", "target":{"file":"src/com/android/providers/media/photopicker/v2/sqlite/SearchRequestDatabaseUtil.java", "function":"addWhereClause"}}]}}, {"package":{"name":"platform/packages/providers/MediaProvider", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-11-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/aed6177baf33a7a3a8cd1d43a74cb0c6d0ebf24e"], "severity":"High", "spl":"2026-11-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"171231985333939436695006900228040759553", "length":1266}, "id":"ASB-A-463363325-4307906b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/aed6177baf33a7a3a8cd1d43a74cb0c6d0ebf24e", "target":{"file":"src/com/android/providers/media/photopicker/v2/sqlite/SearchRequestDatabaseUtil.java", "function":"addSearchRequestIDWhereClause"}}, {"deprecated":false, "digest":{"line_hashes":["76916365870034971198637684103886033135", "128922828884659408288050209043016768915", "217931323205289835552310038977271664885", "318790452508622618792570407031190907601", "14677126980517322556569812481696060860", "255722069000824933372395904868908598545", "171048033038404624932238060707318581954", "69378524261551302396044391961654699783", "71041784633586202127679008814836717912", "276527407471848080530730929749736260652", "319605298363515758662532957772964769170", "128205699815556284236109166532913862814", "125225221194248178477065318859072732940", "160468545528526899065973188028656901371", "26556923393991993163266964239683102825", "94265117873179881763208459735231309873", "149812537929952261424079010877492257397", "293285477897649419218350364825450368496", "212603311783952654257431848135963393613", "317485110783021424248366720322106516291", "72158728852810912070998669554112173300", "38287029669499789899132716117640744016", "156553187957709353709624213439640777468", "292835552961734979416639329203702663037", "213235143565608166079200140108585600166", "66183904103364599588108713597162120033", "147391520002679308898086101312389191988", "60617770341470730220877491565867070372", "63032668325265647257214524225500145135", "45691847782844977569278292612179001240", "90835769712886224221685446776163440252", "263785966325387192560124370737423349310", "90756788071140159586175171957544242750", "303095600871006343587761685968103760864", "63182533702892027775670012053469867290", "221900061160826178880277175874228575526", "128954636333821733601391535804327188413", "80749090080275805368426102220028670129", "122374546446950884044484149631946168737", "293475058886872495219852208599124513913", "332238100481420310684068975939204017627", "227074683579606258644008935206797877590"], "threshold":0.9}, "id":"ASB-A-463363325-851fb38d", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/aed6177baf33a7a3a8cd1d43a74cb0c6d0ebf24e", "target":{"file":"src/com/android/providers/media/photopicker/v2/sqlite/SearchRequestDatabaseUtil.java"}}, {"deprecated":false, "digest":{"function_hash":"210950047188613910655174200572613816358", "length":212}, "id":"ASB-A-463363325-a01b164d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/aed6177baf33a7a3a8cd1d43a74cb0c6d0ebf24e", "target":{"file":"src/com/android/providers/media/photopicker/v2/sqlite/SearchRequestDatabaseUtil.java", "function":"addWhereClause"}}, {"deprecated":false, "digest":{"function_hash":"162760856670847349653271982318324196451", "length":933}, "id":"ASB-A-463363325-ed11de84", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/aed6177baf33a7a3a8cd1d43a74cb0c6d0ebf24e", "target":{"file":"src/com/android/providers/media/photopicker/v2/sqlite/SearchRequestDatabaseUtil.java", "function":"getSearchRequestID"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}