{"id":"ASB-A-503556301", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-10T15:43:18.983809180Z", "aliases":["CVE-2026-49919", "A-503556301"], "details":"In tt_face_colr_blend_layer of ttcolr.c, there is a possible remote code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/external/freetype", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/freetype/+/1ed98bcb2c12fe4b091f76331eb87e4bfd06a2a3"], "severity":"Critical", "spl":"2026-09-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"97235557066984497634424696470174124816", "length":3777}, "id":"ASB-A-503556301-5acb904a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/1ed98bcb2c12fe4b091f76331eb87e4bfd06a2a3", "target":{"file":"src/sfnt/ttcolr.c", "function":"tt_face_colr_blend_layer"}}, {"deprecated":false, "digest":{"line_hashes":["50627479505215735284437109917706726073", "105462463043027474413150166373265447612", "152620721674789381141437778907148675356", "52423357747878251098044166972117762165", "176492909967995815732788262970484458588"], "threshold":0.9}, "id":"ASB-A-503556301-7c148d7c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/1ed98bcb2c12fe4b091f76331eb87e4bfd06a2a3", "target":{"file":"src/sfnt/ttcolr.c"}}]}}, {"package":{"name":"platform/external/freetype", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-09-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/freetype/+/cbb53be32c64802d765e908ae1d7e76eb5e6ead2"], "severity":"Critical", "spl":"2026-09-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["50627479505215735284437109917706726073", "105462463043027474413150166373265447612", "152620721674789381141437778907148675356", "52423357747878251098044166972117762165", "176492909967995815732788262970484458588"], "threshold":0.9}, "id":"ASB-A-503556301-ba4703d1", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/cbb53be32c64802d765e908ae1d7e76eb5e6ead2", "target":{"file":"src/sfnt/ttcolr.c"}}, {"deprecated":false, "digest":{"function_hash":"97235557066984497634424696470174124816", "length":3777}, "id":"ASB-A-503556301-cfe45055", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/cbb53be32c64802d765e908ae1d7e76eb5e6ead2", "target":{"file":"src/sfnt/ttcolr.c", "function":"tt_face_colr_blend_layer"}}]}}, {"package":{"name":"platform/external/freetype", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/freetype/+/89994f1badeeef775693144353d7af43930470c2"], "severity":"Critical", "spl":"2026-09-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["50627479505215735284437109917706726073", "105462463043027474413150166373265447612", "152620721674789381141437778907148675356", "52423357747878251098044166972117762165", "176492909967995815732788262970484458588"], "threshold":0.9}, "id":"ASB-A-503556301-4ef8fefc", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/89994f1badeeef775693144353d7af43930470c2", "target":{"file":"src/sfnt/ttcolr.c"}}, {"deprecated":false, "digest":{"function_hash":"97235557066984497634424696470174124816", "length":3777}, "id":"ASB-A-503556301-506aa5cd", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/89994f1badeeef775693144353d7af43930470c2", "target":{"file":"src/sfnt/ttcolr.c", "function":"tt_face_colr_blend_layer"}}]}}, {"package":{"name":"platform/external/freetype", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/freetype/+/beebd7aab7f3bca9c794d4eac5d2ddd739850779"], "severity":"Critical", "spl":"2026-09-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["50627479505215735284437109917706726073", "105462463043027474413150166373265447612", "152620721674789381141437778907148675356", "52423357747878251098044166972117762165", "176492909967995815732788262970484458588"], "threshold":0.9}, "id":"ASB-A-503556301-8fdee71c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/beebd7aab7f3bca9c794d4eac5d2ddd739850779", "target":{"file":"src/sfnt/ttcolr.c"}}, {"deprecated":false, "digest":{"function_hash":"97235557066984497634424696470174124816", "length":3777}, "id":"ASB-A-503556301-a1b4b731", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/beebd7aab7f3bca9c794d4eac5d2ddd739850779", "target":{"file":"src/sfnt/ttcolr.c", "function":"tt_face_colr_blend_layer"}}]}}, {"package":{"name":"platform/external/freetype", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/freetype/+/a03d4b6378c6187ed068a4e50c80764653d8350b"], "severity":"Critical", "spl":"2026-09-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["50627479505215735284437109917706726073", "105462463043027474413150166373265447612", "152620721674789381141437778907148675356", "52423357747878251098044166972117762165", "176492909967995815732788262970484458588"], "threshold":0.9}, "id":"ASB-A-503556301-185b706a", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/a03d4b6378c6187ed068a4e50c80764653d8350b", "target":{"file":"src/sfnt/ttcolr.c"}}, {"deprecated":false, "digest":{"function_hash":"97235557066984497634424696470174124816", "length":3777}, "id":"ASB-A-503556301-cca1ad1e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/a03d4b6378c6187ed068a4e50c80764653d8350b", "target":{"file":"src/sfnt/ttcolr.c", "function":"tt_face_colr_blend_layer"}}]}}, {"package":{"name":"platform/external/freetype", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-09-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/freetype/+/adad74a00ff51f6ceb60e78dfe1ccd12fbcd5ba7"], "severity":"Critical", "spl":"2026-09-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["50627479505215735284437109917706726073", "105462463043027474413150166373265447612", "152620721674789381141437778907148675356", "52423357747878251098044166972117762165", "176492909967995815732788262970484458588"], "threshold":0.9}, "id":"ASB-A-503556301-50a05cc5", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/adad74a00ff51f6ceb60e78dfe1ccd12fbcd5ba7", "target":{"file":"src/sfnt/ttcolr.c"}}, {"deprecated":false, "digest":{"function_hash":"97235557066984497634424696470174124816", "length":3777}, "id":"ASB-A-503556301-eeeddbb6", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/adad74a00ff51f6ceb60e78dfe1ccd12fbcd5ba7", "target":{"file":"src/sfnt/ttcolr.c", "function":"tt_face_colr_blend_layer"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}