{"id":"ASB-A-501541998", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-10T15:43:18.983809180Z", "aliases":["CVE-2026-28668", "A-501541998"], "details":"In LimitRealloc of malloc_limit.cpp, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/bionic", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/bionic/+/d00918bfbbe06d4a0841d52aabe6dea3a2432787"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["92482470930245716092827180948059807081", "243465704862895372807900642027278501279", "214366867377236410290662491506796335681", "174891498640517482184272933689072722259"], "threshold":0.9}, "id":"ASB-A-501541998-474c0737", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/bionic/+/d00918bfbbe06d4a0841d52aabe6dea3a2432787", "target":{"file":"libc/bionic/malloc_limit.cpp"}}, {"deprecated":false, "digest":{"function_hash":"6596035805164363725151599800663203122", "length":721}, "id":"ASB-A-501541998-f7f98e75", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/bionic/+/d00918bfbbe06d4a0841d52aabe6dea3a2432787", "target":{"file":"libc/bionic/malloc_limit.cpp", "function":"LimitRealloc"}}]}}, {"package":{"name":"platform/bionic", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-09-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/bionic/+/0079f7228b6c91c278281cdcaa43c64044d1f90c"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["92482470930245716092827180948059807081", "243465704862895372807900642027278501279", "214366867377236410290662491506796335681", "174891498640517482184272933689072722259"], "threshold":0.9}, "id":"ASB-A-501541998-193eaf30", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/bionic/+/0079f7228b6c91c278281cdcaa43c64044d1f90c", "target":{"file":"libc/bionic/malloc_limit.cpp"}}, {"deprecated":false, "digest":{"function_hash":"6596035805164363725151599800663203122", "length":721}, "id":"ASB-A-501541998-59a44e73", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/bionic/+/0079f7228b6c91c278281cdcaa43c64044d1f90c", "target":{"file":"libc/bionic/malloc_limit.cpp", "function":"LimitRealloc"}}]}}, {"package":{"name":"platform/bionic", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/bionic/+/a9fbca02c8fb86308957615e9bfda60c2465bd64"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"6596035805164363725151599800663203122", "length":721}, "id":"ASB-A-501541998-0bb49c1d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/bionic/+/a9fbca02c8fb86308957615e9bfda60c2465bd64", "target":{"file":"libc/bionic/malloc_limit.cpp", "function":"LimitRealloc"}}, {"deprecated":false, "digest":{"line_hashes":["92482470930245716092827180948059807081", "243465704862895372807900642027278501279", "214366867377236410290662491506796335681", "174891498640517482184272933689072722259"], "threshold":0.9}, "id":"ASB-A-501541998-4733da6f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/bionic/+/a9fbca02c8fb86308957615e9bfda60c2465bd64", "target":{"file":"libc/bionic/malloc_limit.cpp"}}]}}, {"package":{"name":"platform/bionic", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/bionic/+/f0d785d4f5a9af0ee9b64deeb200eb80964417a1"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["92482470930245716092827180948059807081", "243465704862895372807900642027278501279", "214366867377236410290662491506796335681", "174891498640517482184272933689072722259"], "threshold":0.9}, "id":"ASB-A-501541998-5fb28916", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/bionic/+/f0d785d4f5a9af0ee9b64deeb200eb80964417a1", "target":{"file":"libc/bionic/malloc_limit.cpp"}}, {"deprecated":false, "digest":{"function_hash":"6596035805164363725151599800663203122", "length":721}, "id":"ASB-A-501541998-c8110e16", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/bionic/+/f0d785d4f5a9af0ee9b64deeb200eb80964417a1", "target":{"file":"libc/bionic/malloc_limit.cpp", "function":"LimitRealloc"}}]}}, {"package":{"name":"platform/bionic", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/bionic/+/94db0b5e8c2fcc0d63f5664c1465eaba046b9cae"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"6596035805164363725151599800663203122", "length":721}, "id":"ASB-A-501541998-8fc7c1ae", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/bionic/+/94db0b5e8c2fcc0d63f5664c1465eaba046b9cae", "target":{"file":"libc/bionic/malloc_limit.cpp", "function":"LimitRealloc"}}, {"deprecated":false, "digest":{"line_hashes":["92482470930245716092827180948059807081", "243465704862895372807900642027278501279", "214366867377236410290662491506796335681", "174891498640517482184272933689072722259"], "threshold":0.9}, "id":"ASB-A-501541998-da08984e", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/bionic/+/94db0b5e8c2fcc0d63f5664c1465eaba046b9cae", "target":{"file":"libc/bionic/malloc_limit.cpp"}}]}}, {"package":{"name":"platform/bionic", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-09-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/bionic/+/5b4c918c8365146d9bbd367dafea96fa22415cec"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["92482470930245716092827180948059807081", "243465704862895372807900642027278501279", "214366867377236410290662491506796335681", "174891498640517482184272933689072722259"], "threshold":0.9}, "id":"ASB-A-501541998-242e6b55", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/bionic/+/5b4c918c8365146d9bbd367dafea96fa22415cec", "target":{"file":"libc/bionic/malloc_limit.cpp"}}, {"deprecated":false, "digest":{"function_hash":"6596035805164363725151599800663203122", "length":721}, "id":"ASB-A-501541998-d471200d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/bionic/+/5b4c918c8365146d9bbd367dafea96fa22415cec", "target":{"file":"libc/bionic/malloc_limit.cpp", "function":"LimitRealloc"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}