{"id":"ASB-A-492492028", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-08T15:39:03.104189951Z", "aliases":["CVE-2026-28618", "A-492492028"], "details":"In dec_frm_prepare of oapv.c, there is a possible OOB write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/external/libopenapv", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/libopenapv/+/cf05ca54cffdb52567dbdc30ebc7eeff46b75e05"], "severity":"Critical", "spl":"2026-09-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"188793983053057913566130712144412481575", "length":1945}, "id":"ASB-A-492492028-2f0355f2", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libopenapv/+/cf05ca54cffdb52567dbdc30ebc7eeff46b75e05", "target":{"file":"src/oapv.c", "function":"dec_frm_prepare"}}, {"deprecated":false, "digest":{"line_hashes":["126164020771532226482616017431051074101", "90942867543588952794674708670891517512", "318380084858314903846906075165783976041", "107665252290534563608069792544924973267"], "threshold":0.9}, "id":"ASB-A-492492028-a252032d", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libopenapv/+/cf05ca54cffdb52567dbdc30ebc7eeff46b75e05", "target":{"file":"src/oapv.c"}}]}}, {"package":{"name":"platform/external/libopenapv", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/libopenapv/+/28622a8174204e332b17da89683a0385d7cda857"], "severity":"Critical", "spl":"2026-09-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["126164020771532226482616017431051074101", "90942867543588952794674708670891517512", "318380084858314903846906075165783976041", "107665252290534563608069792544924973267"], "threshold":0.9}, "id":"ASB-A-492492028-0096de5b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libopenapv/+/28622a8174204e332b17da89683a0385d7cda857", "target":{"file":"src/oapv.c"}}, {"deprecated":false, "digest":{"function_hash":"188793983053057913566130712144412481575", "length":1945}, "id":"ASB-A-492492028-8960c499", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libopenapv/+/28622a8174204e332b17da89683a0385d7cda857", "target":{"file":"src/oapv.c", "function":"dec_frm_prepare"}}]}}, {"package":{"name":"platform/external/libopenapv", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/libopenapv/+/f0a82174285352296dce22c6190000ee47633244"], "severity":"Critical", "spl":"2026-09-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"188793983053057913566130712144412481575", "length":1945}, "id":"ASB-A-492492028-0ac4cebb", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libopenapv/+/f0a82174285352296dce22c6190000ee47633244", "target":{"file":"src/oapv.c", "function":"dec_frm_prepare"}}, {"deprecated":false, "digest":{"line_hashes":["126164020771532226482616017431051074101", "90942867543588952794674708670891517512", "318380084858314903846906075165783976041", "107665252290534563608069792544924973267"], "threshold":0.9}, "id":"ASB-A-492492028-eeb86936", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libopenapv/+/f0a82174285352296dce22c6190000ee47633244", "target":{"file":"src/oapv.c"}}]}}, {"package":{"name":"platform/external/libopenapv", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/libopenapv/+/21d001689dd36663a1dfd93ce36f41114146affc"], "severity":"Critical", "spl":"2026-09-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["126164020771532226482616017431051074101", "90942867543588952794674708670891517512", "318380084858314903846906075165783976041", "107665252290534563608069792544924973267"], "threshold":0.9}, "id":"ASB-A-492492028-0f2f9b4c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libopenapv/+/21d001689dd36663a1dfd93ce36f41114146affc", "target":{"file":"src/oapv.c"}}, {"deprecated":false, "digest":{"function_hash":"188793983053057913566130712144412481575", "length":1945}, "id":"ASB-A-492492028-746e73d0", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libopenapv/+/21d001689dd36663a1dfd93ce36f41114146affc", "target":{"file":"src/oapv.c", "function":"dec_frm_prepare"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}