{"id":"ASB-A-503550257", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-10T15:43:18.983809180Z", "aliases":["CVE-2026-45527", "A-503550257"], "details":"In convertCleanApertureToRect of HeifCleanAperture.cpp, there is a possible way to cause a temporary denial of service due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/av", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/5fcd67a562a2dffdfaf25f35c7acf805a96ac8ae"], "severity":"High", "spl":"2026-09-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"210171921972152551315120600398832412273", "length":1178}, "id":"ASB-A-503550257-8d428cca", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/5fcd67a562a2dffdfaf25f35c7acf805a96ac8ae", "target":{"file":"media/module/extractors/mp4/HeifCleanAperture.cpp", "function":"convertCleanApertureToRect"}}, {"deprecated":false, "digest":{"line_hashes":["318736455688245529106157687268192692578", "196019943657244917141137895965964911018", "267706078232852432098468081885247771869", "282099285052783854959186613359706831944", "339627395350488442128001998112282428198", "155817594825882580775796430986338350416", "249145424279417647104309460021634999527", "105135349804760838859480469610730392589", "102715412356406950219770955940244365114"], "threshold":0.9}, "id":"ASB-A-503550257-ed49c964", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/5fcd67a562a2dffdfaf25f35c7acf805a96ac8ae", "target":{"file":"media/module/extractors/mp4/HeifCleanAperture.cpp"}}]}}, {"package":{"name":"platform/frameworks/av", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-09-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/0b5385b693c06f6976aaa1955b704e6afc5f3fc7"], "severity":"High", "spl":"2026-09-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["318736455688245529106157687268192692578", "196019943657244917141137895965964911018", "267706078232852432098468081885247771869", "282099285052783854959186613359706831944", "339627395350488442128001998112282428198", "155817594825882580775796430986338350416", "249145424279417647104309460021634999527", "105135349804760838859480469610730392589", "102715412356406950219770955940244365114"], "threshold":0.9}, "id":"ASB-A-503550257-399bbc6f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/0b5385b693c06f6976aaa1955b704e6afc5f3fc7", "target":{"file":"media/module/extractors/mp4/HeifCleanAperture.cpp"}}, {"deprecated":false, "digest":{"function_hash":"210171921972152551315120600398832412273", "length":1178}, "id":"ASB-A-503550257-8c128ed3", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/0b5385b693c06f6976aaa1955b704e6afc5f3fc7", "target":{"file":"media/module/extractors/mp4/HeifCleanAperture.cpp", "function":"convertCleanApertureToRect"}}]}}, {"package":{"name":"platform/frameworks/av", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/4ee19decff042654c08cd62ece8cc8e0de15d06f"], "severity":"High", "spl":"2026-09-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["318736455688245529106157687268192692578", "196019943657244917141137895965964911018", "267706078232852432098468081885247771869", "282099285052783854959186613359706831944", "339627395350488442128001998112282428198", "155817594825882580775796430986338350416", "249145424279417647104309460021634999527", "105135349804760838859480469610730392589", "102715412356406950219770955940244365114"], "threshold":0.9}, "id":"ASB-A-503550257-86548ffa", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/4ee19decff042654c08cd62ece8cc8e0de15d06f", "target":{"file":"media/module/extractors/mp4/HeifCleanAperture.cpp"}}, {"deprecated":false, "digest":{"function_hash":"210171921972152551315120600398832412273", "length":1178}, "id":"ASB-A-503550257-d72c3bf4", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/4ee19decff042654c08cd62ece8cc8e0de15d06f", "target":{"file":"media/module/extractors/mp4/HeifCleanAperture.cpp", "function":"convertCleanApertureToRect"}}]}}, {"package":{"name":"platform/frameworks/av", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/0c4039a07cc1ac03c4450dc6ca121a41cd7cbfd2"], "severity":"High", "spl":"2026-09-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"210171921972152551315120600398832412273", "length":1178}, "id":"ASB-A-503550257-4a45c07d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/0c4039a07cc1ac03c4450dc6ca121a41cd7cbfd2", "target":{"file":"media/module/extractors/mp4/HeifCleanAperture.cpp", "function":"convertCleanApertureToRect"}}, {"deprecated":false, "digest":{"line_hashes":["318736455688245529106157687268192692578", "196019943657244917141137895965964911018", "267706078232852432098468081885247771869", "282099285052783854959186613359706831944", "339627395350488442128001998112282428198", "155817594825882580775796430986338350416", "249145424279417647104309460021634999527", "105135349804760838859480469610730392589", "102715412356406950219770955940244365114"], "threshold":0.9}, "id":"ASB-A-503550257-b920a1e9", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/0c4039a07cc1ac03c4450dc6ca121a41cd7cbfd2", "target":{"file":"media/module/extractors/mp4/HeifCleanAperture.cpp"}}]}}, {"package":{"name":"platform/frameworks/av", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/91c2a108e4ef9dda4e27c4b83b7fafc76b09cd55"], "severity":"High", "spl":"2026-09-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["318736455688245529106157687268192692578", "196019943657244917141137895965964911018", "267706078232852432098468081885247771869", "282099285052783854959186613359706831944", "339627395350488442128001998112282428198", "155817594825882580775796430986338350416", "249145424279417647104309460021634999527", "105135349804760838859480469610730392589", "102715412356406950219770955940244365114"], "threshold":0.9}, "id":"ASB-A-503550257-2e72f141", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/91c2a108e4ef9dda4e27c4b83b7fafc76b09cd55", "target":{"file":"media/module/extractors/mp4/HeifCleanAperture.cpp"}}, {"deprecated":false, "digest":{"function_hash":"210171921972152551315120600398832412273", "length":1178}, "id":"ASB-A-503550257-b444c574", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/av/+/91c2a108e4ef9dda4e27c4b83b7fafc76b09cd55", "target":{"file":"media/module/extractors/mp4/HeifCleanAperture.cpp", "function":"convertCleanApertureToRect"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}