{"id":"ASB-A-470265726", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-11T15:42:03.104094163Z", "aliases":["CVE-2026-45525", "A-470265726"], "details":"In multiple locations, there is a possible improper data sanitization due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/providers/MediaProvider", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/9f158a138003595ef2fe2907feb85b7b960beebe"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"103144557961431741676219926307699100451", "length":337}, "id":"ASB-A-470265726-0df9578d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/9f158a138003595ef2fe2907feb85b7b960beebe", "target":{"file":"src/com/android/providers/media/util/XmpDataParser.java", "function":"extractXmpData"}}, {"deprecated":false, "digest":{"function_hash":"266033329934119458345049572661103223130", "length":2333}, "id":"ASB-A-470265726-1196238a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/9f158a138003595ef2fe2907feb85b7b960beebe", "target":{"file":"src/com/android/providers/media/util/IsoInterface.java", "function":"parseNextBox"}}, {"deprecated":false, "digest":{"line_hashes":["299751052300986579177727820772392813144", "319546329144307398714913088172692747581", "223360948286094504433170547293088822759", "126621078456103411149045888046307107928", "134296501334970193954554381555275412959", "93899833275520950491689975810517647210", "186879752420847384680508298120120998145", "39662499570216357280364470863519536393", "14636387305516394031381361012918349978", "129115663300458900813395858649971257702"], "threshold":0.9}, "id":"ASB-A-470265726-98cf0e44", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/9f158a138003595ef2fe2907feb85b7b960beebe", "target":{"file":"src/com/android/providers/media/util/IsoInterface.java"}}, {"deprecated":false, "digest":{"function_hash":"306808594666905700037164002730486237120", "length":406}, "id":"ASB-A-470265726-c38ca318", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/9f158a138003595ef2fe2907feb85b7b960beebe", "target":{"file":"src/com/android/providers/media/util/XmpDataParser.java", "function":"getRedactionRanges"}}, {"deprecated":false, "digest":{"line_hashes":["269317359546434617235753054175854878691", "71824064129733685674952744165906152445", "125918452682104437891204300053676274028", "285122698077977787396242658426259525994", "91188067330964356584614093994566711286", "122014763686743706774504381031330434088", "17404969423734519839215597341241536525", "278950053736297824368299276402279355692", "26821439761635470434217090226413024429", "279346366085693778898971755693428512399", "38433449430836815533025651217723549434", "158368883539108715558671888856985959689", "274711825196699276669651779400642705383", "15972954936721298500650884937547810277"], "threshold":0.9}, "id":"ASB-A-470265726-e0702abe", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/9f158a138003595ef2fe2907feb85b7b960beebe", "target":{"file":"src/com/android/providers/media/util/XmpDataParser.java"}}]}}, {"package":{"name":"platform/packages/providers/MediaProvider", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-09-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/308aba831eb69ebabb5c1f98f8dd88568a17a6f2"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["269317359546434617235753054175854878691", "71824064129733685674952744165906152445", "125918452682104437891204300053676274028", "285122698077977787396242658426259525994", "91188067330964356584614093994566711286", "122014763686743706774504381031330434088", "17404969423734519839215597341241536525", "278950053736297824368299276402279355692", "26821439761635470434217090226413024429", "279346366085693778898971755693428512399", "38433449430836815533025651217723549434", "158368883539108715558671888856985959689", "274711825196699276669651779400642705383", "15972954936721298500650884937547810277"], "threshold":0.9}, "id":"ASB-A-470265726-0e98c668", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/308aba831eb69ebabb5c1f98f8dd88568a17a6f2", "target":{"file":"src/com/android/providers/media/util/XmpDataParser.java"}}, {"deprecated":false, "digest":{"function_hash":"306808594666905700037164002730486237120", "length":406}, "id":"ASB-A-470265726-1473fe1c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/308aba831eb69ebabb5c1f98f8dd88568a17a6f2", "target":{"file":"src/com/android/providers/media/util/XmpDataParser.java", "function":"getRedactionRanges"}}, {"deprecated":false, "digest":{"function_hash":"266033329934119458345049572661103223130", "length":2333}, "id":"ASB-A-470265726-32a20cf0", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/308aba831eb69ebabb5c1f98f8dd88568a17a6f2", "target":{"file":"src/com/android/providers/media/util/IsoInterface.java", "function":"parseNextBox"}}, {"deprecated":false, "digest":{"function_hash":"103144557961431741676219926307699100451", "length":337}, "id":"ASB-A-470265726-da71bce4", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/308aba831eb69ebabb5c1f98f8dd88568a17a6f2", "target":{"file":"src/com/android/providers/media/util/XmpDataParser.java", "function":"extractXmpData"}}, {"deprecated":false, "digest":{"line_hashes":["299751052300986579177727820772392813144", "319546329144307398714913088172692747581", "223360948286094504433170547293088822759", "126621078456103411149045888046307107928", "134296501334970193954554381555275412959", "93899833275520950491689975810517647210", "186879752420847384680508298120120998145", "39662499570216357280364470863519536393", "14636387305516394031381361012918349978", "129115663300458900813395858649971257702"], "threshold":0.9}, "id":"ASB-A-470265726-f8715746", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/308aba831eb69ebabb5c1f98f8dd88568a17a6f2", "target":{"file":"src/com/android/providers/media/util/IsoInterface.java"}}]}}, {"package":{"name":"platform/packages/providers/MediaProvider", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/5b0313f2d1fb8747ffcf92135d9ebdc18c2aedeb"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"306808594666905700037164002730486237120", "length":406}, "id":"ASB-A-470265726-19b19805", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/5b0313f2d1fb8747ffcf92135d9ebdc18c2aedeb", "target":{"file":"src/com/android/providers/media/util/XmpDataParser.java", "function":"getRedactionRanges"}}, {"deprecated":false, "digest":{"line_hashes":["299751052300986579177727820772392813144", "319546329144307398714913088172692747581", "223360948286094504433170547293088822759", "126621078456103411149045888046307107928", "134296501334970193954554381555275412959", "93899833275520950491689975810517647210", "186879752420847384680508298120120998145", "39662499570216357280364470863519536393", "14636387305516394031381361012918349978", "129115663300458900813395858649971257702"], "threshold":0.9}, "id":"ASB-A-470265726-662cc527", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/5b0313f2d1fb8747ffcf92135d9ebdc18c2aedeb", "target":{"file":"src/com/android/providers/media/util/IsoInterface.java"}}, {"deprecated":false, "digest":{"function_hash":"103144557961431741676219926307699100451", "length":337}, "id":"ASB-A-470265726-7e047f75", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/5b0313f2d1fb8747ffcf92135d9ebdc18c2aedeb", "target":{"file":"src/com/android/providers/media/util/XmpDataParser.java", "function":"extractXmpData"}}, {"deprecated":false, "digest":{"line_hashes":["269317359546434617235753054175854878691", "71824064129733685674952744165906152445", "125918452682104437891204300053676274028", "285122698077977787396242658426259525994", "91188067330964356584614093994566711286", "122014763686743706774504381031330434088", "17404969423734519839215597341241536525", "278950053736297824368299276402279355692", "26821439761635470434217090226413024429", "279346366085693778898971755693428512399", "38433449430836815533025651217723549434", "158368883539108715558671888856985959689", "274711825196699276669651779400642705383", "15972954936721298500650884937547810277"], "threshold":0.9}, "id":"ASB-A-470265726-b1d4ecc3", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/5b0313f2d1fb8747ffcf92135d9ebdc18c2aedeb", "target":{"file":"src/com/android/providers/media/util/XmpDataParser.java"}}, {"deprecated":false, "digest":{"function_hash":"266033329934119458345049572661103223130", "length":2333}, "id":"ASB-A-470265726-f1d8281e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/5b0313f2d1fb8747ffcf92135d9ebdc18c2aedeb", "target":{"file":"src/com/android/providers/media/util/IsoInterface.java", "function":"parseNextBox"}}]}}, {"package":{"name":"platform/packages/providers/MediaProvider", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/819b4920dd3303d6829771957b7bb34d4469bfe0"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"266033329934119458345049572661103223130", "length":2333}, "id":"ASB-A-470265726-5024c474", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/819b4920dd3303d6829771957b7bb34d4469bfe0", "target":{"file":"src/com/android/providers/media/util/IsoInterface.java", "function":"parseNextBox"}}, {"deprecated":false, "digest":{"line_hashes":["299751052300986579177727820772392813144", "319546329144307398714913088172692747581", "223360948286094504433170547293088822759", "126621078456103411149045888046307107928", "134296501334970193954554381555275412959", "93899833275520950491689975810517647210", "186879752420847384680508298120120998145", "39662499570216357280364470863519536393", "14636387305516394031381361012918349978", "129115663300458900813395858649971257702"], "threshold":0.9}, "id":"ASB-A-470265726-94b4388c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/819b4920dd3303d6829771957b7bb34d4469bfe0", "target":{"file":"src/com/android/providers/media/util/IsoInterface.java"}}, {"deprecated":false, "digest":{"function_hash":"103144557961431741676219926307699100451", "length":337}, "id":"ASB-A-470265726-c840ca4e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/819b4920dd3303d6829771957b7bb34d4469bfe0", "target":{"file":"src/com/android/providers/media/util/XmpDataParser.java", "function":"extractXmpData"}}, {"deprecated":false, "digest":{"function_hash":"306808594666905700037164002730486237120", "length":406}, "id":"ASB-A-470265726-cd9a8a3f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/819b4920dd3303d6829771957b7bb34d4469bfe0", "target":{"file":"src/com/android/providers/media/util/XmpDataParser.java", "function":"getRedactionRanges"}}, {"deprecated":false, "digest":{"line_hashes":["269317359546434617235753054175854878691", "71824064129733685674952744165906152445", "125918452682104437891204300053676274028", "285122698077977787396242658426259525994", "91188067330964356584614093994566711286", "122014763686743706774504381031330434088", "17404969423734519839215597341241536525", "278950053736297824368299276402279355692", "26821439761635470434217090226413024429", "279346366085693778898971755693428512399", "38433449430836815533025651217723549434", "158368883539108715558671888856985959689", "274711825196699276669651779400642705383", "15972954936721298500650884937547810277"], "threshold":0.9}, "id":"ASB-A-470265726-ea31f2b0", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/819b4920dd3303d6829771957b7bb34d4469bfe0", "target":{"file":"src/com/android/providers/media/util/XmpDataParser.java"}}]}}, {"package":{"name":"platform/packages/providers/MediaProvider", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/02f8aa1e99c13f54630db827e137cc49d7911222"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["299751052300986579177727820772392813144", "319546329144307398714913088172692747581", "223360948286094504433170547293088822759", "126621078456103411149045888046307107928", "134296501334970193954554381555275412959", "93899833275520950491689975810517647210", "186879752420847384680508298120120998145", "39662499570216357280364470863519536393", "14636387305516394031381361012918349978", "129115663300458900813395858649971257702"], "threshold":0.9}, "id":"ASB-A-470265726-21721602", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/02f8aa1e99c13f54630db827e137cc49d7911222", "target":{"file":"src/com/android/providers/media/util/IsoInterface.java"}}, {"deprecated":false, "digest":{"function_hash":"306808594666905700037164002730486237120", "length":406}, "id":"ASB-A-470265726-409c1b87", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/02f8aa1e99c13f54630db827e137cc49d7911222", "target":{"file":"src/com/android/providers/media/util/XmpDataParser.java", "function":"getRedactionRanges"}}, {"deprecated":false, "digest":{"line_hashes":["269317359546434617235753054175854878691", "71824064129733685674952744165906152445", "125918452682104437891204300053676274028", "285122698077977787396242658426259525994", "91188067330964356584614093994566711286", "122014763686743706774504381031330434088", "17404969423734519839215597341241536525", "278950053736297824368299276402279355692", "26821439761635470434217090226413024429", "279346366085693778898971755693428512399", "38433449430836815533025651217723549434", "158368883539108715558671888856985959689", "274711825196699276669651779400642705383", "15972954936721298500650884937547810277"], "threshold":0.9}, "id":"ASB-A-470265726-6ad54903", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/02f8aa1e99c13f54630db827e137cc49d7911222", "target":{"file":"src/com/android/providers/media/util/XmpDataParser.java"}}, {"deprecated":false, "digest":{"function_hash":"266033329934119458345049572661103223130", "length":2333}, "id":"ASB-A-470265726-ac791355", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/02f8aa1e99c13f54630db827e137cc49d7911222", "target":{"file":"src/com/android/providers/media/util/IsoInterface.java", "function":"parseNextBox"}}, {"deprecated":false, "digest":{"function_hash":"103144557961431741676219926307699100451", "length":337}, "id":"ASB-A-470265726-fde6da01", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/02f8aa1e99c13f54630db827e137cc49d7911222", "target":{"file":"src/com/android/providers/media/util/XmpDataParser.java", "function":"extractXmpData"}}]}}, {"package":{"name":"platform/packages/providers/MediaProvider", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-09-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/05699c2ef828894b20853c8d41a74976856eb398"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"331602931441201365611056509968051992383", "length":142}, "id":"ASB-A-470265726-046179a9", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/05699c2ef828894b20853c8d41a74976856eb398", "target":{"file":"src/com/android/providers/media/util/XmpInterface.java", "function":"XmpInterface"}}, {"deprecated":false, "digest":{"function_hash":"248260320240320357851467429161466381124", "length":359}, "id":"ASB-A-470265726-31d9bba1", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/05699c2ef828894b20853c8d41a74976856eb398", "target":{"file":"src/com/android/providers/media/util/XmpInterface.java", "function":"fromContainer"}}, {"deprecated":false, "digest":{"line_hashes":["70436264999653520756157422663945732660", "52544879456093650725323136020985427333", "309952451020564125873183919485951133837", "26659430022590428229439050041238224279", "95433494686104262365724575410953376365", "86005271551144645105393610742588591317", "63091517233862485316141916108084909029", "217397584884162510645878132360674502340", "67195285134716229348315829262189571974", "101120781837693410636828582477657202690", "132853953085616742948032896730734868936", "309691425710838159680773516289212272180", "181821219167918211657542249156391942854", "157446601096897880665232148348024485829", "71177363317741537328999397651560357859", "165842132966480055912373173452440840336", "272085920473645309583962160658672039097", "30948039978391980637722660480105263705", "324553337043940790749313833133908918684", "38095202506981033315825161155755627541", "67195285134716229348315829262189571974", "101120781837693410636828582477657202690", "15756033964979387929710785839103493380", "21343224162725910450774849224532475969", "249762536371998812514678778853311551577", "14395240069354917452652434506360879541", "127528785864515227562987714806737028412", "29703638044086351822764786018620172324", "129115663300458900813395858649971257702"], "threshold":0.9}, "id":"ASB-A-470265726-44e40246", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/05699c2ef828894b20853c8d41a74976856eb398", "target":{"file":"src/com/android/providers/media/util/IsoInterface.java"}}, {"deprecated":false, "digest":{"line_hashes":["319749637894102425934435846079683716045", "310915394894743357411382213048453418984", "298820570938566611951857726721099568988", "95434554029011489975293154474995563478", "317722977109585987107727804197627408940", "61941304371344043711765254833063949290", "186973277069390282400284875378836653201", "111015047485015604529980119099500306573", "135149915756129134875102431438514699386", "73510469251690347813908624409544929349", "304686227849224173607294374619406679732", "61107641356919185918544973348801346260", "127398925553244172571866954139867051457", "145615508075938038826877817777942765553", "264603438153108049142735300791940145350", "89127095659942240798108798205862197338"], "threshold":0.9}, "id":"ASB-A-470265726-6649b3ab", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/05699c2ef828894b20853c8d41a74976856eb398", "target":{"file":"src/com/android/providers/media/util/XmpInterface.java"}}, {"deprecated":false, "digest":{"function_hash":"294535578856381592876811056910369527186", "length":2484}, "id":"ASB-A-470265726-a7937282", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/05699c2ef828894b20853c8d41a74976856eb398", "target":{"file":"src/com/android/providers/media/util/IsoInterface.java", "function":"parseNextBox"}}, {"deprecated":false, "digest":{"function_hash":"246918634629305015937421443535615378014", "length":2888}, "id":"ASB-A-470265726-c79430e7", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/05699c2ef828894b20853c8d41a74976856eb398", "target":{"file":"src/com/android/providers/media/util/XmpInterface.java", "function":"process"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}