{"id":"ASB-A-503542587", "published":"2026-10-01T00:00:00Z", "modified":"2026-10-06T15:36:24.859151902Z", "aliases":["CVE-2026-45516", "A-503542587"], "details":"In tt_var_load_item_variation_store of ttgxvar.c, there is a possible out of bounds read due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/external/freetype", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-10-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/freetype/+/46c63346c59373e48e015ee2383f2f8ff5f90232"], "severity":"High", "spl":"2026-10-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"318343513261514701969980884356396947578", "length":4105}, "id":"ASB-A-503542587-55584080", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/46c63346c59373e48e015ee2383f2f8ff5f90232", "target":{"file":"src/truetype/ttgxvar.c", "function":"tt_var_load_item_variation_store"}}, {"deprecated":false, "digest":{"line_hashes":["173775725118845386785921971932501480943", "217990528756814337641523475873168464252", "256299278966677633404315659859596614456", "131613146236841817417653859910863912020", "64709015543735491674836162189416750751", "31847057092482650765499423577043743340", "77677376389532582855417806035044380397", "251390016063463307935723584293454852956"], "threshold":0.9}, "id":"ASB-A-503542587-864f71d3", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/46c63346c59373e48e015ee2383f2f8ff5f90232", "target":{"file":"src/truetype/ttgxvar.c"}}]}}, {"package":{"name":"platform/external/freetype", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-10-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/freetype/+/68c9652af5e4c4764c8803235b288b4f6fce8cf9"], "severity":"High", "spl":"2026-10-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"208113738213926568347286287092880860289", "length":3479}, "id":"ASB-A-503542587-97c5f84f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/68c9652af5e4c4764c8803235b288b4f6fce8cf9", "target":{"file":"src/truetype/ttgxvar.c", "function":"tt_var_load_item_variation_store"}}, {"deprecated":false, "digest":{"line_hashes":["173775725118845386785921971932501480943", "217990528756814337641523475873168464252", "256299278966677633404315659859596614456", "131613146236841817417653859910863912020", "64709015543735491674836162189416750751", "31847057092482650765499423577043743340", "77677376389532582855417806035044380397", "251390016063463307935723584293454852956"], "threshold":0.9}, "id":"ASB-A-503542587-98034925", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/68c9652af5e4c4764c8803235b288b4f6fce8cf9", "target":{"file":"src/truetype/ttgxvar.c"}}]}}, {"package":{"name":"platform/external/freetype", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-10-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/freetype/+/9a879fc426c80c832ca5e1bc02704648e78c29b7"], "severity":"High", "spl":"2026-10-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"208113738213926568347286287092880860289", "length":3479}, "id":"ASB-A-503542587-04b7c44f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/9a879fc426c80c832ca5e1bc02704648e78c29b7", "target":{"file":"src/truetype/ttgxvar.c", "function":"tt_var_load_item_variation_store"}}, {"deprecated":false, "digest":{"line_hashes":["173775725118845386785921971932501480943", "217990528756814337641523475873168464252", "256299278966677633404315659859596614456", "131613146236841817417653859910863912020", "64709015543735491674836162189416750751", "31847057092482650765499423577043743340", "77677376389532582855417806035044380397", "251390016063463307935723584293454852956"], "threshold":0.9}, "id":"ASB-A-503542587-35ea4a9f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/9a879fc426c80c832ca5e1bc02704648e78c29b7", "target":{"file":"src/truetype/ttgxvar.c"}}]}}, {"package":{"name":"platform/external/freetype", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-10-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/freetype/+/d940b83d2fce8b2c87a6f1b9fb628c23a4b46548"], "severity":"High", "spl":"2026-10-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["173775725118845386785921971932501480943", "217990528756814337641523475873168464252", "256299278966677633404315659859596614456", "131613146236841817417653859910863912020", "64709015543735491674836162189416750751", "31847057092482650765499423577043743340", "77677376389532582855417806035044380397", "251390016063463307935723584293454852956"], "threshold":0.9}, "id":"ASB-A-503542587-c94c8a8d", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/d940b83d2fce8b2c87a6f1b9fb628c23a4b46548", "target":{"file":"src/truetype/ttgxvar.c"}}, {"deprecated":false, "digest":{"function_hash":"318343513261514701969980884356396947578", "length":4105}, "id":"ASB-A-503542587-f61c6e80", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/d940b83d2fce8b2c87a6f1b9fb628c23a4b46548", "target":{"file":"src/truetype/ttgxvar.c", "function":"tt_var_load_item_variation_store"}}]}}, {"package":{"name":"platform/external/freetype", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-10-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/freetype/+/e6bcebe7f6e01c36fd7334d31eb0fa531e822ee9"], "severity":"High", "spl":"2026-10-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"318343513261514701969980884356396947578", "length":4105}, "id":"ASB-A-503542587-3f36209c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/e6bcebe7f6e01c36fd7334d31eb0fa531e822ee9", "target":{"file":"src/truetype/ttgxvar.c", "function":"tt_var_load_item_variation_store"}}, {"deprecated":false, "digest":{"line_hashes":["173775725118845386785921971932501480943", "217990528756814337641523475873168464252", "256299278966677633404315659859596614456", "131613146236841817417653859910863912020", "64709015543735491674836162189416750751", "31847057092482650765499423577043743340", "77677376389532582855417806035044380397", "251390016063463307935723584293454852956"], "threshold":0.9}, "id":"ASB-A-503542587-58186162", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/e6bcebe7f6e01c36fd7334d31eb0fa531e822ee9", "target":{"file":"src/truetype/ttgxvar.c"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-10-01"}]}