{"id":"ASB-A-485377744", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-10T15:43:18.983809180Z", "aliases":["CVE-2026-28609", "A-485377744"], "details":"In read of MatroskaExtractor.cpp, there is a possible out-of-bounds write due to improper casting. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/av", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/11fab348d2f19f961aa5f77ebd982302b1c6fb97"], "severity":"High", "spl":"2026-09-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"130309124943095167992892561007649601929", "length":3382}, "id":"ASB-A-485377744-5e2b9f64", "match_only_versions":["17-next"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/11fab348d2f19f961aa5f77ebd982302b1c6fb97", "target":{"file":"media/module/extractors/mkv/MatroskaExtractor.cpp", "function":"MatroskaSource::read"}}, {"deprecated":false, "digest":{"line_hashes":["140625882455802095473998649509075544909", "152176519520389055099570309723006715530", "282407496075505354279707914805690913101", "300713635019519034519916956871977702490", "99336833860655455306008330526130631718", "230277543580148863041176000085537438870", "111158476575025450042098193687808676781"], "threshold":0.9}, "id":"ASB-A-485377744-8e3a4df4", "match_only_versions":["17-next"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/11fab348d2f19f961aa5f77ebd982302b1c6fb97", "target":{"file":"media/module/extractors/mkv/MatroskaExtractor.cpp"}}]}}, {"package":{"name":"platform/frameworks/av", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-09-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/4e120822e71e91de33849fa6e85df1d9321d3671"], "severity":"High", "spl":"2026-09-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"130309124943095167992892561007649601929", "length":3382}, "id":"ASB-A-485377744-a736ee6a", "match_only_versions":["15"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/4e120822e71e91de33849fa6e85df1d9321d3671", "target":{"file":"media/module/extractors/mkv/MatroskaExtractor.cpp", "function":"MatroskaSource::read"}}, {"deprecated":false, "digest":{"line_hashes":["140625882455802095473998649509075544909", "152176519520389055099570309723006715530", "282407496075505354279707914805690913101", "300713635019519034519916956871977702490", "99336833860655455306008330526130631718", "230277543580148863041176000085537438870", "111158476575025450042098193687808676781"], "threshold":0.9}, "id":"ASB-A-485377744-d1cb8e7e", "match_only_versions":["15"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/4e120822e71e91de33849fa6e85df1d9321d3671", "target":{"file":"media/module/extractors/mkv/MatroskaExtractor.cpp"}}]}}, {"package":{"name":"platform/frameworks/av", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/a4955af6dee107f449137db905e6817c10a76610"], "severity":"High", "spl":"2026-09-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["140625882455802095473998649509075544909", "152176519520389055099570309723006715530", "282407496075505354279707914805690913101", "300713635019519034519916956871977702490", "99336833860655455306008330526130631718", "230277543580148863041176000085537438870", "111158476575025450042098193687808676781"], "threshold":0.9}, "id":"ASB-A-485377744-5142c48b", "match_only_versions":["16"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/a4955af6dee107f449137db905e6817c10a76610", "target":{"file":"media/module/extractors/mkv/MatroskaExtractor.cpp"}}, {"deprecated":false, "digest":{"function_hash":"130309124943095167992892561007649601929", "length":3382}, "id":"ASB-A-485377744-647ef61d", "match_only_versions":["16"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/a4955af6dee107f449137db905e6817c10a76610", "target":{"file":"media/module/extractors/mkv/MatroskaExtractor.cpp", "function":"MatroskaSource::read"}}]}}, {"package":{"name":"platform/frameworks/av", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/22f16d4f8514ce82c618e69cfb323931ffbd362e"], "severity":"High", "spl":"2026-09-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"130309124943095167992892561007649601929", "length":3382}, "id":"ASB-A-485377744-15199eb4", "match_only_versions":["16-qpr2"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/22f16d4f8514ce82c618e69cfb323931ffbd362e", "target":{"file":"media/module/extractors/mkv/MatroskaExtractor.cpp", "function":"MatroskaSource::read"}}, {"deprecated":false, "digest":{"line_hashes":["140625882455802095473998649509075544909", "152176519520389055099570309723006715530", "282407496075505354279707914805690913101", "300713635019519034519916956871977702490", "99336833860655455306008330526130631718", "230277543580148863041176000085537438870", "111158476575025450042098193687808676781"], "threshold":0.9}, "id":"ASB-A-485377744-b81dd4dc", "match_only_versions":["16-qpr2"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/22f16d4f8514ce82c618e69cfb323931ffbd362e", "target":{"file":"media/module/extractors/mkv/MatroskaExtractor.cpp"}}]}}, {"package":{"name":"platform/frameworks/av", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-09-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/1415c9197362583134d90580ce7c37c2020089d7"], "severity":"High", "spl":"2026-09-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"130309124943095167992892561007649601929", "length":3382}, "id":"ASB-A-485377744-18c6651e", "match_only_versions":["14"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/1415c9197362583134d90580ce7c37c2020089d7", "target":{"file":"media/module/extractors/mkv/MatroskaExtractor.cpp", "function":"MatroskaSource::read"}}, {"deprecated":false, "digest":{"line_hashes":["140625882455802095473998649509075544909", "152176519520389055099570309723006715530", "282407496075505354279707914805690913101", "300713635019519034519916956871977702490", "99336833860655455306008330526130631718", "230277543580148863041176000085537438870", "111158476575025450042098193687808676781"], "threshold":0.9}, "id":"ASB-A-485377744-da3fbcad", "match_only_versions":["14"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/1415c9197362583134d90580ce7c37c2020089d7", "target":{"file":"media/module/extractors/mkv/MatroskaExtractor.cpp"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}