{"id":"ASB-A-470260357", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-10T15:43:18.983809180Z", "aliases":["CVE-2026-28638", "A-470260357"], "details":"In multiple functions of XmpDataParser.java, there is a possible improper data sanitization due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/providers/MediaProvider", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/45f2ffa35a51435b4c0e3373eb8bf599a4a41385"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"53498194965219284433246573201801406221", "length":751}, "id":"ASB-A-470260357-62e2cf5f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/45f2ffa35a51435b4c0e3373eb8bf599a4a41385", "target":{"file":"src/com/android/providers/media/util/XmpDataParser.java", "function":"getRedactedRanges"}}, {"deprecated":false, "digest":{"line_hashes":["139019374469907848883149012165290390666", "154214643294986802485010700366450562491", "24071736427376423958150902249444613700", "173649537450929519208591593148997290957", "321211582682436860761677669996318792835", "263677083219920055740348447963866751495", "339751086063770822985195697106103831532", "7591193015993448773598933907302346772", "200371566254905875979692960561929165064", "241031382440076574091913957027805028735", "318153582356822671471399093938565306118", "288627813990066417743400065277444111292", "37137924550274780265692463281959039349"], "threshold":0.9}, "id":"ASB-A-470260357-63f2e730", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/45f2ffa35a51435b4c0e3373eb8bf599a4a41385", "target":{"file":"src/com/android/providers/media/util/IsoInterface.java"}}, {"deprecated":false, "digest":{"function_hash":"31197847065459353983086374118689690107", "length":2318}, "id":"ASB-A-470260357-9b21b393", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/45f2ffa35a51435b4c0e3373eb8bf599a4a41385", "target":{"file":"src/com/android/providers/media/util/IsoInterface.java", "function":"parseNextBox"}}, {"deprecated":false, "digest":{"function_hash":"235791605050907809053143576823791752996", "length":1594}, "id":"ASB-A-470260357-c31321df", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/45f2ffa35a51435b4c0e3373eb8bf599a4a41385", "target":{"file":"src/com/android/providers/media/util/XmpDataParser.java", "function":"createXmpInterface"}}, {"deprecated":false, "digest":{"line_hashes":["300707658198959447866819276204349977527", "42800589265725813318814735908566933217", "273816268564629297619741278966508554541", "35566612771065051064984343924431876841", "53479503242825780523290935749253838384", "58691097408361763171094254198789922446", "116112222061210095387958922282827611972", "151579894189680858236665854975673964134", "100485817361247346326674979082686883088", "53479503242825780523290935749253838384", "224037505632530177812465456908827710847", "129388558587196218865155692490855406922", "32021996656339932888296238700414970686"], "threshold":0.9}, "id":"ASB-A-470260357-e44049ec", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/45f2ffa35a51435b4c0e3373eb8bf599a4a41385", "target":{"file":"src/com/android/providers/media/util/XmpDataParser.java"}}]}}, {"package":{"name":"platform/packages/providers/MediaProvider", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-09-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/bfc999867e15c3d33156acc2031bcd5e87bfc7cb"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["176599297263104599027713961911712039160", "254181884392477951059756935879629811661", "299669561104182702833857143261270440572", "332774085690513636110398252245727501110", "220710608384611299043104450355283107479", "217519488556177369408465741657793701750", "139019374469907848883149012165290390666", "154214643294986802485010700366450562491", "24071736427376423958150902249444613700", "173649537450929519208591593148997290957", "321211582682436860761677669996318792835", "263677083219920055740348447963866751495", "339751086063770822985195697106103831532", "7591193015993448773598933907302346772", "200371566254905875979692960561929165064", "27858627843799272577576105009687712398", "252334015848980530973333689391719484391", "329378396278259998333049942314469255612", "265415445218507616764043139664062005126", "70436264999653520756157422663945732660", "52544879456093650725323136020985427333", "309952451020564125873183919485951133837", "339338171687937088764314062692355611166", "202222262790244756731793805635094909361", "156576028830853027018308160797528388930", "49719916104321119277195173823726204289", "328131461490795240973241790790293253333", "108488276016755345752764428743540929253", "262733388766505298057016110861449587508", "233635316116031966287380904930360368194", "283687828544218199860334829631222427278", "6918057190497854706407186834553147990", "13873672172771408973798448885656923419", "30384805623799429441453441752079671125", "39050586264698251303230528999675577055", "87977312275772364535516322366913751241", "116883659960172081919868574222072158077", "105827561005444964397610693996922233453", "46746397112722383874403021858030360518", "37634261098587033590809743251317129273", "182759586492134323830783986238931261943", "152227407617756011337649871478382416834", "191382697269645695857497683953937445622", "158834199601828857670018683220455761375", "63353107242120770219706924000064741423", "106927545009871068953838612445176044037", "26659430022590428229439050041238224279", "95433494686104262365724575410953376365", "86005271551144645105393610742588591317", "63091517233862485316141916108084909029", "217397584884162510645878132360674502340", "67195285134716229348315829262189571974", "101120781837693410636828582477657202690", "132853953085616742948032896730734868936", "309691425710838159680773516289212272180", "181821219167918211657542249156391942854", "157446601096897880665232148348024485829", "71177363317741537328999397651560357859", "165842132966480055912373173452440840336", "272085920473645309583962160658672039097", "30948039978391980637722660480105263705", "324553337043940790749313833133908918684", "38095202506981033315825161155755627541", "67195285134716229348315829262189571974", "101120781837693410636828582477657202690", "15756033964979387929710785839103493380", "21343224162725910450774849224532475969", "249762536371998812514678778853311551577", "14395240069354917452652434506360879541", "127528785864515227562987714806737028412", "29703638044086351822764786018620172324", "138347460089070346676054521991419089980", "29721425037595847362348929793362200775", "63843711104405186234463960877396894794", "312193819698559601224078332132078148166", "70907351644059069487093150054642056171", "271052438154280253380678377933798137595", "275934716996823330776115704808124346247", "264651653040913797314347115799252196114", "16385505743361647722751234373008896035", "62878721758994511197139268215745691504", "13102740727067076110688370578902883358", "87804842760622046613028460315428307954", "70923392634863839674687640560086868572", "244844252456544249812857212411303944502", "73778072311712099433206709984711536439", "140283356826906673420144130124648299067", "330013381353795327427204765925952649286", "247806692021056364738379853400517596122", "31911580630747575462466541408144704917", "35497311752500451245695791300554720701", "173501313154420631007362294233712337199", "298308132561507082539218677002215688264", "331874809900336383926175753862747541994", "335320846846770423638053624742695522230", "296250514862955626547214867048871875727", "69682427190823443098984436356613927844", "114155968985086681884486978777721664637", "53071418003207551202017789583779672210", "170622403549247248598405251734991742746", "9637071190144418063896817526503142781", "240452842244767412685219290999891378898", "245147345090774558614531370006799612957", "209421641628667105363258952698613219355", "102634619635075071437691910619339990100", "295679175857800462199858166924970310272", "216489990982821172077639470575460347656", "1548481234842052299684178024207781536", "70205059280736897673841929707643657897", "216811567387114854152353309130072021818", "261637228046304924227179565801133929482", "13324022457491663333353783680112059474", "160333655280249655536685744260984224438", "199902530898077018142665363721371638964", "159165135071022568550882862184931669177", "146826048406655923733129295536812848792", "124009907172451052516205506197302545978"], "threshold":0.9}, "id":"ASB-A-470260357-59ca518e", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/bfc999867e15c3d33156acc2031bcd5e87bfc7cb", "target":{"file":"src/com/android/providers/media/util/IsoInterface.java"}}, {"deprecated":false, "digest":{"function_hash":"294535578856381592876811056910369527186", "length":2484}, "id":"ASB-A-470260357-5d016c98", "match_only_versions":["15"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/bfc999867e15c3d33156acc2031bcd5e87bfc7cb", "target":{"file":"src/com/android/providers/media/util/IsoInterface.java", "function":"parseNextBox"}}, {"deprecated":false, "digest":{"function_hash":"139819183845860221123318106081215103355", "length":408}, "id":"ASB-A-470260357-67df7c1d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/bfc999867e15c3d33156acc2031bcd5e87bfc7cb", "target":{"file":"src/com/android/providers/media/util/IsoInterface.java", "function":"getBoxRanges"}}, {"deprecated":false, "digest":{"function_hash":"53498194965219284433246573201801406221", "length":751}, "id":"ASB-A-470260357-71c42825", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/bfc999867e15c3d33156acc2031bcd5e87bfc7cb", "target":{"file":"src/com/android/providers/media/util/XmpDataParser.java", "function":"getRedactedRanges"}}, {"deprecated":false, "digest":{"function_hash":"235791605050907809053143576823791752996", "length":1594}, "id":"ASB-A-470260357-77beb969", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/bfc999867e15c3d33156acc2031bcd5e87bfc7cb", "target":{"file":"src/com/android/providers/media/util/XmpDataParser.java", "function":"createXmpInterface"}}, {"deprecated":false, "digest":{"function_hash":"110483400219956000313488006294664809237", "length":193}, "id":"ASB-A-470260357-8de9a5ec", "match_only_versions":["15"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/bfc999867e15c3d33156acc2031bcd5e87bfc7cb", "target":{"file":"src/com/android/providers/media/util/IsoInterface.java", "function":"getBoxBytes"}}, {"deprecated":false, "digest":{"line_hashes":["72707033652150818911797645367446555018", "76388866888260289115256263732958911384", "103710072774082645015080997773853124184", "255181295957724075385629984105796373204", "300707658198959447866819276204349977527", "42800589265725813318814735908566933217", "273816268564629297619741278966508554541", "35566612771065051064984343924431876841", "53479503242825780523290935749253838384", "58691097408361763171094254198789922446", "116112222061210095387958922282827611972", "151579894189680858236665854975673964134", "100485817361247346326674979082686883088", "53479503242825780523290935749253838384", "224037505632530177812465456908827710847", "129388558587196218865155692490855406922", "32021996656339932888296238700414970686", "337876715549357170015586462467925949657", "224485079649286334871598869520914770770", "13753196113848432556313463689011719019", "103987833091287386708413275053325024451", "41970114793819671963936685597969796786", "16319000436150959502761117006880100462"], "threshold":0.9}, "id":"ASB-A-470260357-97264a29", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/bfc999867e15c3d33156acc2031bcd5e87bfc7cb", "target":{"file":"src/com/android/providers/media/util/XmpDataParser.java"}}, {"deprecated":false, "digest":{"function_hash":"151566292673205220545929894312043449382", "length":419}, "id":"ASB-A-470260357-9e6657bb", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/bfc999867e15c3d33156acc2031bcd5e87bfc7cb", "target":{"file":"src/com/android/providers/media/util/XmpDataParser.java", "function":"extractXmpData"}}, {"deprecated":false, "digest":{"function_hash":"34780955856336653542649077657166668375", "length":1039}, "id":"ASB-A-470260357-ca8a3b5e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/bfc999867e15c3d33156acc2031bcd5e87bfc7cb", "target":{"file":"src/com/android/providers/media/util/IsoInterface.java", "function":"IsoInterface"}}]}}, {"package":{"name":"platform/packages/providers/MediaProvider", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/76a189311b2c178146704933a03c0042aabf3dee"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"53498194965219284433246573201801406221", "length":751}, "id":"ASB-A-470260357-2c11ab9c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/76a189311b2c178146704933a03c0042aabf3dee", "target":{"file":"src/com/android/providers/media/util/XmpDataParser.java", "function":"getRedactedRanges"}}, {"deprecated":false, "digest":{"function_hash":"31197847065459353983086374118689690107", "length":2318}, "id":"ASB-A-470260357-2c7631e9", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/76a189311b2c178146704933a03c0042aabf3dee", "target":{"file":"src/com/android/providers/media/util/IsoInterface.java", "function":"parseNextBox"}}, {"deprecated":false, "digest":{"line_hashes":["300707658198959447866819276204349977527", "42800589265725813318814735908566933217", "273816268564629297619741278966508554541", "35566612771065051064984343924431876841", "53479503242825780523290935749253838384", "58691097408361763171094254198789922446", "116112222061210095387958922282827611972", "151579894189680858236665854975673964134", "100485817361247346326674979082686883088", "53479503242825780523290935749253838384", "224037505632530177812465456908827710847", "129388558587196218865155692490855406922", "32021996656339932888296238700414970686"], "threshold":0.9}, "id":"ASB-A-470260357-35037132", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/76a189311b2c178146704933a03c0042aabf3dee", "target":{"file":"src/com/android/providers/media/util/XmpDataParser.java"}}, {"deprecated":false, "digest":{"function_hash":"235791605050907809053143576823791752996", "length":1594}, "id":"ASB-A-470260357-a0dff28f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/76a189311b2c178146704933a03c0042aabf3dee", "target":{"file":"src/com/android/providers/media/util/XmpDataParser.java", "function":"createXmpInterface"}}, {"deprecated":false, "digest":{"line_hashes":["139019374469907848883149012165290390666", "154214643294986802485010700366450562491", "24071736427376423958150902249444613700", "173649537450929519208591593148997290957", "321211582682436860761677669996318792835", "263677083219920055740348447963866751495", "339751086063770822985195697106103831532", "7591193015993448773598933907302346772", "200371566254905875979692960561929165064", "241031382440076574091913957027805028735", "318153582356822671471399093938565306118", "288627813990066417743400065277444111292", "37137924550274780265692463281959039349"], "threshold":0.9}, "id":"ASB-A-470260357-e6b549d8", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/76a189311b2c178146704933a03c0042aabf3dee", "target":{"file":"src/com/android/providers/media/util/IsoInterface.java"}}]}}, {"package":{"name":"platform/packages/providers/MediaProvider", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/8e3f336bdac49ed4a3fb6ce835c645677d95a767"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"235791605050907809053143576823791752996", "length":1594}, "id":"ASB-A-470260357-0669a238", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/8e3f336bdac49ed4a3fb6ce835c645677d95a767", "target":{"file":"src/com/android/providers/media/util/XmpDataParser.java", "function":"createXmpInterface"}}, {"deprecated":false, "digest":{"line_hashes":["300707658198959447866819276204349977527", "42800589265725813318814735908566933217", "273816268564629297619741278966508554541", "35566612771065051064984343924431876841", "53479503242825780523290935749253838384", "58691097408361763171094254198789922446", "116112222061210095387958922282827611972", "151579894189680858236665854975673964134", "100485817361247346326674979082686883088", "53479503242825780523290935749253838384", "224037505632530177812465456908827710847", "129388558587196218865155692490855406922", "32021996656339932888296238700414970686"], "threshold":0.9}, "id":"ASB-A-470260357-5cbf7a2f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/8e3f336bdac49ed4a3fb6ce835c645677d95a767", "target":{"file":"src/com/android/providers/media/util/XmpDataParser.java"}}, {"deprecated":false, "digest":{"function_hash":"53498194965219284433246573201801406221", "length":751}, "id":"ASB-A-470260357-5f61b638", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/8e3f336bdac49ed4a3fb6ce835c645677d95a767", "target":{"file":"src/com/android/providers/media/util/XmpDataParser.java", "function":"getRedactedRanges"}}, {"deprecated":false, "digest":{"function_hash":"31197847065459353983086374118689690107", "length":2318}, "id":"ASB-A-470260357-7cf53922", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/8e3f336bdac49ed4a3fb6ce835c645677d95a767", "target":{"file":"src/com/android/providers/media/util/IsoInterface.java", "function":"parseNextBox"}}, {"deprecated":false, "digest":{"line_hashes":["139019374469907848883149012165290390666", "154214643294986802485010700366450562491", "24071736427376423958150902249444613700", "173649537450929519208591593148997290957", "321211582682436860761677669996318792835", "263677083219920055740348447963866751495", "339751086063770822985195697106103831532", "7591193015993448773598933907302346772", "200371566254905875979692960561929165064", "241031382440076574091913957027805028735", "318153582356822671471399093938565306118", "288627813990066417743400065277444111292", "37137924550274780265692463281959039349"], "threshold":0.9}, "id":"ASB-A-470260357-e9617a56", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/8e3f336bdac49ed4a3fb6ce835c645677d95a767", "target":{"file":"src/com/android/providers/media/util/IsoInterface.java"}}]}}, {"package":{"name":"platform/packages/providers/MediaProvider", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/6a3b6d521624237ab6785ec5ed2f230d54a2e232"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["139019374469907848883149012165290390666", "154214643294986802485010700366450562491", "24071736427376423958150902249444613700", "173649537450929519208591593148997290957", "321211582682436860761677669996318792835", "263677083219920055740348447963866751495", "339751086063770822985195697106103831532", "7591193015993448773598933907302346772", "200371566254905875979692960561929165064", "241031382440076574091913957027805028735", "318153582356822671471399093938565306118", "288627813990066417743400065277444111292", "37137924550274780265692463281959039349"], "threshold":0.9}, "id":"ASB-A-470260357-26c0fdf3", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/6a3b6d521624237ab6785ec5ed2f230d54a2e232", "target":{"file":"src/com/android/providers/media/util/IsoInterface.java"}}, {"deprecated":false, "digest":{"function_hash":"235791605050907809053143576823791752996", "length":1594}, "id":"ASB-A-470260357-33bb5748", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/6a3b6d521624237ab6785ec5ed2f230d54a2e232", "target":{"file":"src/com/android/providers/media/util/XmpDataParser.java", "function":"createXmpInterface"}}, {"deprecated":false, "digest":{"line_hashes":["300707658198959447866819276204349977527", "42800589265725813318814735908566933217", "273816268564629297619741278966508554541", "35566612771065051064984343924431876841", "53479503242825780523290935749253838384", "58691097408361763171094254198789922446", "116112222061210095387958922282827611972", "151579894189680858236665854975673964134", "100485817361247346326674979082686883088", "53479503242825780523290935749253838384", "224037505632530177812465456908827710847", "129388558587196218865155692490855406922", "32021996656339932888296238700414970686"], "threshold":0.9}, "id":"ASB-A-470260357-4c148875", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/6a3b6d521624237ab6785ec5ed2f230d54a2e232", "target":{"file":"src/com/android/providers/media/util/XmpDataParser.java"}}, {"deprecated":false, "digest":{"function_hash":"53498194965219284433246573201801406221", "length":751}, "id":"ASB-A-470260357-b9c34571", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/6a3b6d521624237ab6785ec5ed2f230d54a2e232", "target":{"file":"src/com/android/providers/media/util/XmpDataParser.java", "function":"getRedactedRanges"}}, {"deprecated":false, "digest":{"function_hash":"31197847065459353983086374118689690107", "length":2318}, "id":"ASB-A-470260357-b9d2efcc", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/6a3b6d521624237ab6785ec5ed2f230d54a2e232", "target":{"file":"src/com/android/providers/media/util/IsoInterface.java", "function":"parseNextBox"}}]}}, {"package":{"name":"platform/packages/providers/MediaProvider", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-09-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/9a24010a0f6f0b8af447e4ed572f0779d97064d3"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["153622369469749217235478173589577955737", "298960112418395175489223917168168228799", "183971744947464265466009364927906126286", "318024155564243172750423788209111999790", "271823171898762391633152389535683414977", "181458774425495773180626514446230621050", "256062960251967156323426443672909751988", "274735048032091525835736654743071148102", "67298625760332816916608283913689549241", "86573112798828629461892876543409462146", "148302010429220420830873942771066354803", "80201308237587834085688573131328882789", "284162215666689926104585979197798024109", "16284831908715471103435708207529814711", "10886163604728957660075060295330065394", "219611193278080941351467483403545835223", "114918675381291345118499150432526716856", "26710007355526978778624379394008188950", "143914382156394425869188581112624695095", "98276455687322232553592008714252121244", "221373033542575247643221444659338593783", "126597116597343119979520830367051382618", "203500876898754736753118997541787502054", "29972851485292597051594035591846292693", "330506227813488846037644685953108516883", "31410827716590745502279565197000665215", "278950053736297824368299276402279355692", "26821439761635470434217090226413024429", "279346366085693778898971755693428512399", "38433449430836815533025651217723549434", "158368883539108715558671888856985959689", "70144639610715706616611116747263012050", "231252919973230711571126011558183297215", "335455727354937101337859760539548662551", "272060900069005272386622106901942827268"], "threshold":0.9}, "id":"ASB-A-470260357-7b35f8ce", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/9a24010a0f6f0b8af447e4ed572f0779d97064d3", "target":{"file":"src/com/android/providers/media/util/XmpInterface.java"}}, {"deprecated":false, "digest":{"line_hashes":["150518362772554007985550838446511996572", "86643670419601506190911768216944449023", "24051434030853729275767085684961525636", "13324022457491663333353783680112059474", "160333655280249655536685744260984224438", "199902530898077018142665363721371638964", "64315445162977426719310525821870228545", "114960204107246419179278335075694842510", "233010191679027282760467103534847011396"], "threshold":0.9}, "id":"ASB-A-470260357-9b235477", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/9a24010a0f6f0b8af447e4ed572f0779d97064d3", "target":{"file":"src/com/android/providers/media/util/IsoInterface.java"}}, {"deprecated":false, "digest":{"function_hash":"215616568274008026300684336350359661179", "length":533}, "id":"ASB-A-470260357-cc7dd5e4", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/9a24010a0f6f0b8af447e4ed572f0779d97064d3", "target":{"file":"src/com/android/providers/media/util/XmpInterface.java", "function":"fromContainer"}}, {"deprecated":false, "digest":{"function_hash":"288753861412405049147180605481321465118", "length":2241}, "id":"ASB-A-470260357-f47e1385", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/9a24010a0f6f0b8af447e4ed572f0779d97064d3", "target":{"file":"src/com/android/providers/media/util/XmpInterface.java", "function":"XmpInterface"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}