{"id":"ASB-A-466091304", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-10T15:43:18.983809180Z", "aliases":["CVE-2026-58839", "A-466091304"], "details":"In forEachLine of MountRegistry.cpp, there is a possible out of bounds read due to a buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/system/incremental_delivery", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/incremental_delivery/+/07f1345a34d3b7dd2054f51730a3a2423d75feb2"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"77901611107430095085820501892191841586", "length":3257}, "id":"ASB-A-466091304-56aa4208", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/incremental_delivery/+/07f1345a34d3b7dd2054f51730a3a2423d75feb2", "target":{"file":"incfs/MountRegistry.cpp", "function":"MountRegistry::Mounts::loadFrom"}}, {"deprecated":false, "digest":{"function_hash":"12874265435631223553710128538833993797", "length":900}, "id":"ASB-A-466091304-760f0052", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/incremental_delivery/+/07f1345a34d3b7dd2054f51730a3a2423d75feb2", "target":{"file":"incfs/MountRegistry.cpp", "function":"forEachLine"}}, {"deprecated":false, "digest":{"line_hashes":["213494211576338406158818322625149119112", "179033028908046322781903310185765842038", "76203621689151990787784922428356750163", "207642138715070231107481360527976875625", "290465456282574680618849643780810081371", "119695939684742444938310553255852257674", "321496537711863837832097436927912685892", "203388116802623663266026432129982973979", "112973675553680936452319393185061860249", "327815023930355873693114169759353342655", "105130219174071444001332376782260748864"], "threshold":0.9}, "id":"ASB-A-466091304-d4b4b348", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/incremental_delivery/+/07f1345a34d3b7dd2054f51730a3a2423d75feb2", "target":{"file":"incfs/MountRegistry.cpp"}}]}}, {"package":{"name":"platform/system/incremental_delivery", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-09-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/incremental_delivery/+/c3b528280e0b621ba78a5a9e080d865f99e69cbd"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"12874265435631223553710128538833993797", "length":900}, "id":"ASB-A-466091304-7a262b2c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/incremental_delivery/+/c3b528280e0b621ba78a5a9e080d865f99e69cbd", "target":{"file":"incfs/MountRegistry.cpp", "function":"forEachLine"}}, {"deprecated":false, "digest":{"function_hash":"77901611107430095085820501892191841586", "length":3257}, "id":"ASB-A-466091304-997ec2bd", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/incremental_delivery/+/c3b528280e0b621ba78a5a9e080d865f99e69cbd", "target":{"file":"incfs/MountRegistry.cpp", "function":"MountRegistry::Mounts::loadFrom"}}, {"deprecated":false, "digest":{"line_hashes":["213494211576338406158818322625149119112", "179033028908046322781903310185765842038", "76203621689151990787784922428356750163", "207642138715070231107481360527976875625", "290465456282574680618849643780810081371", "119695939684742444938310553255852257674", "321496537711863837832097436927912685892", "203388116802623663266026432129982973979", "112973675553680936452319393185061860249", "327815023930355873693114169759353342655", "105130219174071444001332376782260748864"], "threshold":0.9}, "id":"ASB-A-466091304-e62f54f7", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/incremental_delivery/+/c3b528280e0b621ba78a5a9e080d865f99e69cbd", "target":{"file":"incfs/MountRegistry.cpp"}}]}}, {"package":{"name":"platform/system/incremental_delivery", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/incremental_delivery/+/71c3c0252b97e29cefda24bee4f598b925a4d605"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"77901611107430095085820501892191841586", "length":3257}, "id":"ASB-A-466091304-771451eb", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/incremental_delivery/+/71c3c0252b97e29cefda24bee4f598b925a4d605", "target":{"file":"incfs/MountRegistry.cpp", "function":"MountRegistry::Mounts::loadFrom"}}, {"deprecated":false, "digest":{"line_hashes":["213494211576338406158818322625149119112", "179033028908046322781903310185765842038", "76203621689151990787784922428356750163", "207642138715070231107481360527976875625", "290465456282574680618849643780810081371", "119695939684742444938310553255852257674", "321496537711863837832097436927912685892", "203388116802623663266026432129982973979", "112973675553680936452319393185061860249", "327815023930355873693114169759353342655", "105130219174071444001332376782260748864"], "threshold":0.9}, "id":"ASB-A-466091304-b2878b4e", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/incremental_delivery/+/71c3c0252b97e29cefda24bee4f598b925a4d605", "target":{"file":"incfs/MountRegistry.cpp"}}, {"deprecated":false, "digest":{"function_hash":"12874265435631223553710128538833993797", "length":900}, "id":"ASB-A-466091304-e0695cc7", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/incremental_delivery/+/71c3c0252b97e29cefda24bee4f598b925a4d605", "target":{"file":"incfs/MountRegistry.cpp", "function":"forEachLine"}}]}}, {"package":{"name":"platform/system/incremental_delivery", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/incremental_delivery/+/11ecefff0126fdda36405ca7773746275e33426c"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"12874265435631223553710128538833993797", "length":900}, "id":"ASB-A-466091304-4f307dd0", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/incremental_delivery/+/11ecefff0126fdda36405ca7773746275e33426c", "target":{"file":"incfs/MountRegistry.cpp", "function":"forEachLine"}}, {"deprecated":false, "digest":{"line_hashes":["213494211576338406158818322625149119112", "179033028908046322781903310185765842038", "76203621689151990787784922428356750163", "207642138715070231107481360527976875625", "290465456282574680618849643780810081371", "119695939684742444938310553255852257674", "321496537711863837832097436927912685892", "203388116802623663266026432129982973979", "112973675553680936452319393185061860249", "327815023930355873693114169759353342655", "105130219174071444001332376782260748864"], "threshold":0.9}, "id":"ASB-A-466091304-6650e358", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/incremental_delivery/+/11ecefff0126fdda36405ca7773746275e33426c", "target":{"file":"incfs/MountRegistry.cpp"}}, {"deprecated":false, "digest":{"function_hash":"77901611107430095085820501892191841586", "length":3257}, "id":"ASB-A-466091304-bfd3b3f7", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/incremental_delivery/+/11ecefff0126fdda36405ca7773746275e33426c", "target":{"file":"incfs/MountRegistry.cpp", "function":"MountRegistry::Mounts::loadFrom"}}]}}, {"package":{"name":"platform/system/incremental_delivery", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-09-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/incremental_delivery/+/85cff3c7b99e1883c8358d0a458f92579da29baa"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"12874265435631223553710128538833993797", "length":900}, "id":"ASB-A-466091304-3d294bea", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/incremental_delivery/+/85cff3c7b99e1883c8358d0a458f92579da29baa", "target":{"file":"incfs/MountRegistry.cpp", "function":"forEachLine"}}, {"deprecated":false, "digest":{"line_hashes":["213494211576338406158818322625149119112", "179033028908046322781903310185765842038", "76203621689151990787784922428356750163", "207642138715070231107481360527976875625", "290465456282574680618849643780810081371", "119695939684742444938310553255852257674", "321496537711863837832097436927912685892", "203388116802623663266026432129982973979", "112973675553680936452319393185061860249", "327815023930355873693114169759353342655", "105130219174071444001332376782260748864"], "threshold":0.9}, "id":"ASB-A-466091304-63b10e77", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/incremental_delivery/+/85cff3c7b99e1883c8358d0a458f92579da29baa", "target":{"file":"incfs/MountRegistry.cpp"}}, {"deprecated":false, "digest":{"function_hash":"77901611107430095085820501892191841586", "length":3257}, "id":"ASB-A-466091304-856c3b09", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/incremental_delivery/+/85cff3c7b99e1883c8358d0a458f92579da29baa", "target":{"file":"incfs/MountRegistry.cpp", "function":"MountRegistry::Mounts::loadFrom"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}