{"id":"ASB-A-489675413", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-10T15:43:18.983809180Z", "aliases":["CVE-2026-28664", "A-489675413"], "details":"In WriteImageToDisk of runtime_image.cc, there is a possible file tampering due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/art", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/art/+/a18d72596e17970c975ea556cba1901a2ec721bf"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"213079555896585880585941577427003582621", "length":1637}, "id":"ASB-A-489675413-2abe0951", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/art/+/a18d72596e17970c975ea556cba1901a2ec721bf", "target":{"file":"runtime/runtime_image.cc", "function":"RuntimeImage::WriteImageToDisk"}}, {"deprecated":false, "digest":{"line_hashes":["216210274985700102284342446384212751041", "67911428384017015493713999009631408461", "121986270982351234078889799710563259994", "54643721442907182004746021029503882116", "40031297761308761984389250907450517108"], "threshold":0.9}, "id":"ASB-A-489675413-8d8a479b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/art/+/a18d72596e17970c975ea556cba1901a2ec721bf", "target":{"file":"runtime/runtime_image.cc"}}]}}, {"package":{"name":"platform/art", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-09-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/art/+/b61e34ca43ef0e47d6596cd7e7ea9c8632391a30"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"213079555896585880585941577427003582621", "length":1637}, "id":"ASB-A-489675413-969600b6", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/art/+/b61e34ca43ef0e47d6596cd7e7ea9c8632391a30", "target":{"file":"runtime/runtime_image.cc", "function":"RuntimeImage::WriteImageToDisk"}}, {"deprecated":false, "digest":{"line_hashes":["216210274985700102284342446384212751041", "67911428384017015493713999009631408461", "121986270982351234078889799710563259994", "54643721442907182004746021029503882116", "40031297761308761984389250907450517108"], "threshold":0.9}, "id":"ASB-A-489675413-b38f5b1f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/art/+/b61e34ca43ef0e47d6596cd7e7ea9c8632391a30", "target":{"file":"runtime/runtime_image.cc"}}]}}, {"package":{"name":"platform/art", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/art/+/3ad14a0377d3fbdb334eabb9c80f19d34790e9ef"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"213079555896585880585941577427003582621", "length":1637}, "id":"ASB-A-489675413-22956982", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/art/+/3ad14a0377d3fbdb334eabb9c80f19d34790e9ef", "target":{"file":"runtime/runtime_image.cc", "function":"RuntimeImage::WriteImageToDisk"}}, {"deprecated":false, "digest":{"line_hashes":["216210274985700102284342446384212751041", "67911428384017015493713999009631408461", "121986270982351234078889799710563259994", "54643721442907182004746021029503882116", "40031297761308761984389250907450517108"], "threshold":0.9}, "id":"ASB-A-489675413-28eca50b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/art/+/3ad14a0377d3fbdb334eabb9c80f19d34790e9ef", "target":{"file":"runtime/runtime_image.cc"}}]}}, {"package":{"name":"platform/art", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/art/+/0c996e5b0820094f83f156f60e05e0c0c7601aa1"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["216210274985700102284342446384212751041", "67911428384017015493713999009631408461", "121986270982351234078889799710563259994", "54643721442907182004746021029503882116", "40031297761308761984389250907450517108"], "threshold":0.9}, "id":"ASB-A-489675413-61fba061", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/art/+/0c996e5b0820094f83f156f60e05e0c0c7601aa1", "target":{"file":"runtime/runtime_image.cc"}}, {"deprecated":false, "digest":{"function_hash":"213079555896585880585941577427003582621", "length":1637}, "id":"ASB-A-489675413-839ab319", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/art/+/0c996e5b0820094f83f156f60e05e0c0c7601aa1", "target":{"file":"runtime/runtime_image.cc", "function":"RuntimeImage::WriteImageToDisk"}}]}}, {"package":{"name":"platform/art", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/art/+/4cf977edf749e68ae197d1253dbf615b66f27da1"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["216210274985700102284342446384212751041", "67911428384017015493713999009631408461", "121986270982351234078889799710563259994", "54643721442907182004746021029503882116", "40031297761308761984389250907450517108"], "threshold":0.9}, "id":"ASB-A-489675413-741dd78c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/art/+/4cf977edf749e68ae197d1253dbf615b66f27da1", "target":{"file":"runtime/runtime_image.cc"}}, {"deprecated":false, "digest":{"function_hash":"213079555896585880585941577427003582621", "length":1637}, "id":"ASB-A-489675413-920f200a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/art/+/4cf977edf749e68ae197d1253dbf615b66f27da1", "target":{"file":"runtime/runtime_image.cc", "function":"RuntimeImage::WriteImageToDisk"}}]}}, {"package":{"name":"platform/art", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-09-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/art/+/df13ed080817c5912e1198831359b2cde4058274"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["39803797984905864385172808429312507052", "5682816742476304190931468281625766801", "121986270982351234078889799710563259994", "54643721442907182004746021029503882116", "40031297761308761984389250907450517108"], "threshold":0.9}, "id":"ASB-A-489675413-67c527b4", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/art/+/df13ed080817c5912e1198831359b2cde4058274", "target":{"file":"runtime/runtime_image.cc"}}, {"deprecated":false, "digest":{"function_hash":"66302533928130072526660604533593425243", "length":1583}, "id":"ASB-A-489675413-90925f3a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/art/+/df13ed080817c5912e1198831359b2cde4058274", "target":{"file":"runtime/runtime_image.cc", "function":"RuntimeImage::WriteImageToDisk"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}