{"id":"ASB-A-498720726", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-09T15:15:54.249544283Z", "aliases":["CVE-2026-28594", "A-498720726"], "details":"In multiple locations, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/daf86f667f9d8922af019155f8a672cca88c6f71"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"76900263193821131613803144858038446815", "length":1161}, "id":"ASB-A-498720726-1021c921", "match_only_versions":["17-next"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/daf86f667f9d8922af019155f8a672cca88c6f71", "target":{"file":"core/jni/android_util_MemoryIntArray.cpp", "function":"android_util_MemoryIntArray_open"}}, {"deprecated":false, "digest":{"function_hash":"131701758285787395297905332457470791737", "length":355}, "id":"ASB-A-498720726-29681208", "match_only_versions":["17-next"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/daf86f667f9d8922af019155f8a672cca88c6f71", "target":{"file":"core/java/android/util/MemoryIntArray.java", "function":"MemoryIntArray"}}, {"deprecated":false, "digest":{"function_hash":"54008343303569645723833411385589645739", "length":765}, "id":"ASB-A-498720726-47b62007", "match_only_versions":["17-next"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/daf86f667f9d8922af019155f8a672cca88c6f71", "target":{"file":"core/jni/android_util_MemoryIntArray.cpp", "function":"android_util_MemoryIntArray_create"}}, {"deprecated":false, "digest":{"line_hashes":["291922031398692510497560056864533368952", "227506297400933504963646301717120503104", "104638150338775150101656333873490316177", "107480972324893069453549329433513446698", "136445929339844975200811835264935636489", "242464893937605967049964177092723965229", "9412631001575639785114500168280286836", "320528159802038150585474044698579747756", "335832926160292829086306275655036011655", "96245542921365624695362216522992334683"], "threshold":0.9}, "id":"ASB-A-498720726-752c7ec6", "match_only_versions":["17-next"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/daf86f667f9d8922af019155f8a672cca88c6f71", "target":{"file":"core/tests/utiltests/jni/registration.cpp"}}, {"deprecated":false, "digest":{"line_hashes":["152815109277170133695153505211749735658", "155044243200771554719303149137651472707", "208511731064627399958747115307265737133", "7531244446045422166020472046957915986", "217199346926436915797355971599916226771", "180502946815144274557173276854138514432", "231620737672136973603056563070047038213", "68081413217840510718011349453948719638", "150202046933768071157777637458122373137", "18056015648009628007615971470510765625", "122405822305269018493445926114987952611", "231620737672136973603056563070047038213", "214246854821834111154135886698317198582", "145020545018180516325726880534416301950", "178406821604928443969524244160203848439", "258191090984401892040679504607555474622", "123756796487934467035933598340554439383", "149855342357537560890122607809656368851", "208340516746309916234459030526445352469", "5645389750264270427721531489413298243", "187239258287230248717499559141092282117", "336916498327133487779821517935655388731"], "threshold":0.9}, "id":"ASB-A-498720726-8d153353", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/daf86f667f9d8922af019155f8a672cca88c6f71", "target":{"file":"core/java/android/util/MemoryIntArray.java"}}, {"deprecated":false, "digest":{"function_hash":"38166435893550139268687204945826879693", "length":565}, "id":"ASB-A-498720726-9928d119", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/daf86f667f9d8922af019155f8a672cca88c6f71", "target":{"file":"core/jni/android_util_MemoryIntArray.cpp", "function":"android_util_MemoryIntArray_close"}}, {"deprecated":false, "digest":{"function_hash":"174779443649482355402812409544076413984", "length":386}, "id":"ASB-A-498720726-9a60a654", "match_only_versions":["17-next"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/daf86f667f9d8922af019155f8a672cca88c6f71", "target":{"file":"core/jni/android_util_MemoryIntArray.cpp", "function":"android_util_MemoryIntArray_size"}}, {"deprecated":false, "digest":{"function_hash":"248509001113494497336422510635248940189", "length":346}, "id":"ASB-A-498720726-a4f48509", "match_only_versions":["17-next"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/daf86f667f9d8922af019155f8a672cca88c6f71", "target":{"file":"core/java/android/util/MemoryIntArray.java", "function":"MemoryIntArray"}}, {"deprecated":false, "digest":{"function_hash":"27729224489676775308724795026202759707", "length":141}, "id":"ASB-A-498720726-ea33a7ae", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/daf86f667f9d8922af019155f8a672cca88c6f71", "target":{"file":"core/java/android/util/MemoryIntArray.java", "function":"close"}}, {"deprecated":false, "digest":{"line_hashes":["311811326995784262900725300333338938267", "240736600444888457353209709794480217054", "58089579335046525064191414007314326716", "204484563079203397550973469818208086778", "238310551684556503738917843574333596131", "195861596220917129249635877703978886291", "299099740268635222488232310788876240013", "14059129678279052728588938558666256695", "220203372314011995781013863888168900573", "134069253562633038573050742371654051399", "337944621513963730967243117885625310391", "101058603297410948177699007007988580526", "32922156444162708257741505061568619686", "156858808719786810417049322123269990147", "306114047834057060657819930428296966803", "159520141018659611442291465916451546211", "137669828787957745782993742012303206367", "311711192902333379256457748338265388856", "254808117467127051497503912293764907265", "184013063584249746995358584091604296239", "234791026868904197269105805435512544749", "41662073655321480079009449172789350285", "163533690022180619795790641261917938514", "140139006821557093181572162454224419262", "176132557022473757585193781553631770908", "81718571384538978944973511953000005179", "195209324845594445471998838001339384798", "45940792907980987070707038998959379431", "159520141018659611442291465916451546211", "144876369797070497723855306680629882482", "86557364217833776852929471661899946110", "238707739712339597154474992204293910681", "132241855419767745929843832054270210463", "187299110898556200123727065453998874846", "156727147963386350366449290037760500296", "209571206259975371020523558334951542284", "288450508006988723224801985988920219356", "46582513359544985551230770308964004066", "289401712196183531448332484052858386028"], "threshold":0.9}, "id":"ASB-A-498720726-f976d6b1", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/daf86f667f9d8922af019155f8a672cca88c6f71", "target":{"file":"core/jni/android_util_MemoryIntArray.cpp"}}]}}, {"package":{"name":"platform/system/core", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/core/+/a580fc27e6b7c2671932de0f5d8ad9701b294385", "https://android.googlesource.com/platform/system/core/+/5ceaa348e48cb98a0e69c8771f1bd57b818484ba"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["51864448609087483291833739809251800346", "54249544875072714184090895650188953976", "303931456850462550863377332666616362383", "48544250685677423603873946627292517014"], "threshold":0.9}, "id":"ASB-A-498720726-b0a9a9a3", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/core/+/a580fc27e6b7c2671932de0f5d8ad9701b294385", "target":{"file":"libcutils/ashmem-dev.cpp"}}, {"deprecated":false, "digest":{"function_hash":"294614984570886117998757781952533473446", "length":302}, "id":"ASB-A-498720726-f065493f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/core/+/a580fc27e6b7c2671932de0f5d8ad9701b294385", "target":{"file":"libcutils/ashmem-dev.cpp", "function":"is_memfd_fd"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/cd59384e8abf79ba2500521a9ca1bfe8712bd058"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"174779443649482355402812409544076413984", "length":386}, "id":"ASB-A-498720726-15122ac3", "match_only_versions":["16-qpr2"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/cd59384e8abf79ba2500521a9ca1bfe8712bd058", "target":{"file":"core/jni/android_util_MemoryIntArray.cpp", "function":"android_util_MemoryIntArray_size"}}, {"deprecated":false, "digest":{"function_hash":"258370251725014200354979439969542612271", "length":152}, "id":"ASB-A-498720726-2814558b", "match_only_versions":["16-qpr2"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/cd59384e8abf79ba2500521a9ca1bfe8712bd058", "target":{"file":"core/java/android/util/MemoryIntArray.java", "function":"close"}}, {"deprecated":false, "digest":{"function_hash":"76900263193821131613803144858038446815", "length":1161}, "id":"ASB-A-498720726-5143afc7", "match_only_versions":["16-qpr2"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/cd59384e8abf79ba2500521a9ca1bfe8712bd058", "target":{"file":"core/jni/android_util_MemoryIntArray.cpp", "function":"android_util_MemoryIntArray_open"}}, {"deprecated":false, "digest":{"function_hash":"248509001113494497336422510635248940189", "length":346}, "id":"ASB-A-498720726-5ae4cd41", "match_only_versions":["16-qpr2"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/cd59384e8abf79ba2500521a9ca1bfe8712bd058", "target":{"file":"core/java/android/util/MemoryIntArray.java", "function":"MemoryIntArray"}}, {"deprecated":false, "digest":{"function_hash":"86907412614706650414672207661141222366", "length":734}, "id":"ASB-A-498720726-639500ea", "match_only_versions":["16-qpr2"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/cd59384e8abf79ba2500521a9ca1bfe8712bd058", "target":{"file":"core/jni/android_util_MemoryIntArray.cpp", "function":"android_util_MemoryIntArray_close"}}, {"deprecated":false, "digest":{"line_hashes":["217981669874337348334468120438590560078", "313899853530975773070210225059994386015", "183114897519304616231303506308704474889", "204484563079203397550973469818208086778", "238310551684556503738917843574333596131", "195861596220917129249635877703978886291", "299099740268635222488232310788876240013", "14059129678279052728588938558666256695", "220203372314011995781013863888168900573", "134069253562633038573050742371654051399", "337944621513963730967243117885625310391", "101058603297410948177699007007988580526", "32922156444162708257741505061568619686", "156858808719786810417049322123269990147", "306114047834057060657819930428296966803", "159520141018659611442291465916451546211", "137669828787957745782993742012303206367", "311711192902333379256457748338265388856", "254808117467127051497503912293764907265", "184013063584249746995358584091604296239", "234791026868904197269105805435512544749", "237399824082355171803806174453051408786", "168866028214546303593812897752657471820", "265727123508470120161816844928365339506", "138358744177680671772556003696639989389", "195209324845594445471998838001339384798", "45940792907980987070707038998959379431", "159520141018659611442291465916451546211", "144876369797070497723855306680629882482", "86557364217833776852929471661899946110", "238707739712339597154474992204293910681", "132241855419767745929843832054270210463", "187299110898556200123727065453998874846", "156727147963386350366449290037760500296", "96861780103249433926832284597492581711", "55031492406895493045355130587506714384", "122046409545616616863161581740573453220", "15047999727329752975758374416259142832"], "threshold":0.9}, "id":"ASB-A-498720726-6a636053", "match_only_versions":["16-qpr2"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/cd59384e8abf79ba2500521a9ca1bfe8712bd058", "target":{"file":"core/jni/android_util_MemoryIntArray.cpp"}}, {"deprecated":false, "digest":{"function_hash":"131701758285787395297905332457470791737", "length":355}, "id":"ASB-A-498720726-96be0a3a", "match_only_versions":["16-qpr2"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/cd59384e8abf79ba2500521a9ca1bfe8712bd058", "target":{"file":"core/java/android/util/MemoryIntArray.java", "function":"MemoryIntArray"}}, {"deprecated":false, "digest":{"line_hashes":["152815109277170133695153505211749735658", "155044243200771554719303149137651472707", "208511731064627399958747115307265737133", "7531244446045422166020472046957915986", "217199346926436915797355971599916226771", "180502946815144274557173276854138514432", "231620737672136973603056563070047038213", "68081413217840510718011349453948719638", "150202046933768071157777637458122373137", "18056015648009628007615971470510765625", "122405822305269018493445926114987952611", "231620737672136973603056563070047038213", "214246854821834111154135886698317198582", "158617706979392150424008179447293565317", "323663085141508824425948754104244052453", "52435412407735527814054716598127462554", "212598529887545182981902451735541018066", "149855342357537560890122607809656368851", "60922196011202981417148685765374097866", "190899188725762232425487290901874453838", "135513710757755156780476203163166331128", "171968603838340288005503334105224416324"], "threshold":0.9}, "id":"ASB-A-498720726-ab91f5cd", "match_only_versions":["16-qpr2"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/cd59384e8abf79ba2500521a9ca1bfe8712bd058", "target":{"file":"core/java/android/util/MemoryIntArray.java"}}, {"deprecated":false, "digest":{"line_hashes":["291922031398692510497560056864533368952", "227506297400933504963646301717120503104", "104638150338775150101656333873490316177", "107480972324893069453549329433513446698", "136445929339844975200811835264935636489", "242464893937605967049964177092723965229", "9412631001575639785114500168280286836", "320528159802038150585474044698579747756", "335832926160292829086306275655036011655", "96245542921365624695362216522992334683"], "threshold":0.9}, "id":"ASB-A-498720726-cb17ea71", "match_only_versions":["16-qpr2"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/cd59384e8abf79ba2500521a9ca1bfe8712bd058", "target":{"file":"core/tests/utiltests/jni/registration.cpp"}}, {"deprecated":false, "digest":{"function_hash":"54008343303569645723833411385589645739", "length":765}, "id":"ASB-A-498720726-d0ab2e4f", "match_only_versions":["16-qpr2"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/cd59384e8abf79ba2500521a9ca1bfe8712bd058", "target":{"file":"core/jni/android_util_MemoryIntArray.cpp", "function":"android_util_MemoryIntArray_create"}}]}}, {"package":{"name":"platform/system/core", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/core/+/4892c4587fe6e58e445d16b8675365e3030de0dc", "https://android.googlesource.com/platform/system/core/+/d97d77a6400ceab97a8acc55531e04424266fc01"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["51864448609087483291833739809251800346", "54249544875072714184090895650188953976", "303931456850462550863377332666616362383", "48544250685677423603873946627292517014"], "threshold":0.9}, "id":"ASB-A-498720726-2b211b68", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/core/+/4892c4587fe6e58e445d16b8675365e3030de0dc", "target":{"file":"libcutils/ashmem-dev.cpp"}}, {"deprecated":false, "digest":{"function_hash":"294614984570886117998757781952533473446", "length":302}, "id":"ASB-A-498720726-435e17c5", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/core/+/4892c4587fe6e58e445d16b8675365e3030de0dc", "target":{"file":"libcutils/ashmem-dev.cpp", "function":"is_memfd_fd"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/a44880c82aac2a343ae56ac65ccb349b08bdbc17"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"27729224489676775308724795026202759707", "length":141}, "id":"ASB-A-498720726-16d812f8", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a44880c82aac2a343ae56ac65ccb349b08bdbc17", "target":{"file":"core/java/android/util/MemoryIntArray.java", "function":"close"}}, {"deprecated":false, "digest":{"function_hash":"54008343303569645723833411385589645739", "length":765}, "id":"ASB-A-498720726-2229ac0d", "match_only_versions":["17"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a44880c82aac2a343ae56ac65ccb349b08bdbc17", "target":{"file":"core/jni/android_util_MemoryIntArray.cpp", "function":"android_util_MemoryIntArray_create"}}, {"deprecated":false, "digest":{"line_hashes":["291922031398692510497560056864533368952", "227506297400933504963646301717120503104", "104638150338775150101656333873490316177", "107480972324893069453549329433513446698", "136445929339844975200811835264935636489", "242464893937605967049964177092723965229", "9412631001575639785114500168280286836", "320528159802038150585474044698579747756", "335832926160292829086306275655036011655", "96245542921365624695362216522992334683"], "threshold":0.9}, "id":"ASB-A-498720726-506be119", "match_only_versions":["17"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a44880c82aac2a343ae56ac65ccb349b08bdbc17", "target":{"file":"core/tests/utiltests/jni/registration.cpp"}}, {"deprecated":false, "digest":{"line_hashes":["152815109277170133695153505211749735658", "155044243200771554719303149137651472707", "208511731064627399958747115307265737133", "7531244446045422166020472046957915986", "217199346926436915797355971599916226771", "180502946815144274557173276854138514432", "231620737672136973603056563070047038213", "68081413217840510718011349453948719638", "150202046933768071157777637458122373137", "18056015648009628007615971470510765625", "122405822305269018493445926114987952611", "231620737672136973603056563070047038213", "214246854821834111154135886698317198582", "145020545018180516325726880534416301950", "178406821604928443969524244160203848439", "258191090984401892040679504607555474622", "123756796487934467035933598340554439383", "149855342357537560890122607809656368851", "208340516746309916234459030526445352469", "5645389750264270427721531489413298243", "187239258287230248717499559141092282117", "336916498327133487779821517935655388731"], "threshold":0.9}, "id":"ASB-A-498720726-63287d54", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a44880c82aac2a343ae56ac65ccb349b08bdbc17", "target":{"file":"core/java/android/util/MemoryIntArray.java"}}, {"deprecated":false, "digest":{"function_hash":"248509001113494497336422510635248940189", "length":346}, "id":"ASB-A-498720726-652fd8ec", "match_only_versions":["17"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a44880c82aac2a343ae56ac65ccb349b08bdbc17", "target":{"file":"core/java/android/util/MemoryIntArray.java", "function":"MemoryIntArray"}}, {"deprecated":false, "digest":{"function_hash":"38166435893550139268687204945826879693", "length":565}, "id":"ASB-A-498720726-714f9110", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a44880c82aac2a343ae56ac65ccb349b08bdbc17", "target":{"file":"core/jni/android_util_MemoryIntArray.cpp", "function":"android_util_MemoryIntArray_close"}}, {"deprecated":false, "digest":{"function_hash":"174779443649482355402812409544076413984", "length":386}, "id":"ASB-A-498720726-9aefe33c", "match_only_versions":["17"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a44880c82aac2a343ae56ac65ccb349b08bdbc17", "target":{"file":"core/jni/android_util_MemoryIntArray.cpp", "function":"android_util_MemoryIntArray_size"}}, {"deprecated":false, "digest":{"function_hash":"76900263193821131613803144858038446815", "length":1161}, "id":"ASB-A-498720726-a86acd4a", "match_only_versions":["17"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a44880c82aac2a343ae56ac65ccb349b08bdbc17", "target":{"file":"core/jni/android_util_MemoryIntArray.cpp", "function":"android_util_MemoryIntArray_open"}}, {"deprecated":false, "digest":{"line_hashes":["311811326995784262900725300333338938267", "240736600444888457353209709794480217054", "58089579335046525064191414007314326716", "204484563079203397550973469818208086778", "238310551684556503738917843574333596131", "195861596220917129249635877703978886291", "299099740268635222488232310788876240013", "14059129678279052728588938558666256695", "220203372314011995781013863888168900573", "134069253562633038573050742371654051399", "337944621513963730967243117885625310391", "101058603297410948177699007007988580526", "32922156444162708257741505061568619686", "156858808719786810417049322123269990147", "306114047834057060657819930428296966803", "159520141018659611442291465916451546211", "137669828787957745782993742012303206367", "311711192902333379256457748338265388856", "254808117467127051497503912293764907265", "184013063584249746995358584091604296239", "234791026868904197269105805435512544749", "41662073655321480079009449172789350285", "163533690022180619795790641261917938514", "140139006821557093181572162454224419262", "176132557022473757585193781553631770908", "81718571384538978944973511953000005179", "195209324845594445471998838001339384798", "45940792907980987070707038998959379431", "159520141018659611442291465916451546211", "144876369797070497723855306680629882482", "86557364217833776852929471661899946110", "238707739712339597154474992204293910681", "132241855419767745929843832054270210463", "187299110898556200123727065453998874846", "156727147963386350366449290037760500296", "209571206259975371020523558334951542284", "288450508006988723224801985988920219356", "46582513359544985551230770308964004066", "289401712196183531448332484052858386028"], "threshold":0.9}, "id":"ASB-A-498720726-bf7bc3f0", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a44880c82aac2a343ae56ac65ccb349b08bdbc17", "target":{"file":"core/jni/android_util_MemoryIntArray.cpp"}}, {"deprecated":false, "digest":{"function_hash":"131701758285787395297905332457470791737", "length":355}, "id":"ASB-A-498720726-e9ce09c5", "match_only_versions":["17"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a44880c82aac2a343ae56ac65ccb349b08bdbc17", "target":{"file":"core/java/android/util/MemoryIntArray.java", "function":"MemoryIntArray"}}]}}, {"package":{"name":"platform/system/core", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/core/+/6297cab2c921135a98183a84e2b75ed4d74b910c", "https://android.googlesource.com/platform/system/core/+/2de25eeaec5500f0bfbc5d1ae320ca8c702e39f6"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"294614984570886117998757781952533473446", "length":302}, "id":"ASB-A-498720726-1e004a2d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/core/+/6297cab2c921135a98183a84e2b75ed4d74b910c", "target":{"file":"libcutils/ashmem-dev.cpp", "function":"is_memfd_fd"}}, {"deprecated":false, "digest":{"line_hashes":["51864448609087483291833739809251800346", "54249544875072714184090895650188953976", "303931456850462550863377332666616362383", "48544250685677423603873946627292517014"], "threshold":0.9}, "id":"ASB-A-498720726-f49d4a78", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/core/+/6297cab2c921135a98183a84e2b75ed4d74b910c", "target":{"file":"libcutils/ashmem-dev.cpp"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}