{"id":"ASB-A-505748392", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-05T16:32:28.703711716Z", "aliases":["CVE-2026-58995", "A-505748392"], "details":"In getEntryFileName of ZipFileRO.cpp, there is a possible memory safety issue due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/6da5fc97ce52a80efbc46af3cb3330152b6d7e1b"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"194482363648532907574043945036591750697", "length":405}, "id":"ASB-A-505748392-3856055c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/6da5fc97ce52a80efbc46af3cb3330152b6d7e1b", "target":{"file":"libs/androidfw/ZipFileRO.cpp", "function":"ZipFileRO::getEntryFileName"}}, {"deprecated":false, "digest":{"line_hashes":["217393691783784062743186263382289736587", "251243380099684899172006670758014669102", "160757615909430888168392578688260034243"], "threshold":0.9}, "id":"ASB-A-505748392-5f04d57c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/6da5fc97ce52a80efbc46af3cb3330152b6d7e1b", "target":{"file":"libs/androidfw/include/androidfw/ZipFileRO.h"}}, {"deprecated":false, "digest":{"line_hashes":["255273107764280999950999932921386056299", "200770063162390918579106892912898843566", "127628624804953613033083286504704442189", "10770843555836785776292486916865778428", "148386236082038627021727118362863878045", "229865868111145925047752915818625423152"], "threshold":0.9}, "id":"ASB-A-505748392-7e384ba3", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/6da5fc97ce52a80efbc46af3cb3330152b6d7e1b", "target":{"file":"libs/androidfw/ZipFileRO.cpp"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-11-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/c003ce6c6c4ee148722bdb6ba9407a4c349e61a5"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"194482363648532907574043945036591750697", "length":405}, "id":"ASB-A-505748392-2645f6ef", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/c003ce6c6c4ee148722bdb6ba9407a4c349e61a5", "target":{"file":"libs/androidfw/ZipFileRO.cpp", "function":"ZipFileRO::getEntryFileName"}}, {"deprecated":false, "digest":{"line_hashes":["255273107764280999950999932921386056299", "200770063162390918579106892912898843566", "127628624804953613033083286504704442189", "10770843555836785776292486916865778428", "148386236082038627021727118362863878045", "229865868111145925047752915818625423152"], "threshold":0.9}, "id":"ASB-A-505748392-e6314177", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/c003ce6c6c4ee148722bdb6ba9407a4c349e61a5", "target":{"file":"libs/androidfw/ZipFileRO.cpp"}}, {"deprecated":false, "digest":{"line_hashes":["217393691783784062743186263382289736587", "251243380099684899172006670758014669102", "160757615909430888168392578688260034243"], "threshold":0.9}, "id":"ASB-A-505748392-f7f9990a", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/c003ce6c6c4ee148722bdb6ba9407a4c349e61a5", "target":{"file":"libs/androidfw/include/androidfw/ZipFileRO.h"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-11-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/61053a062cdffc5c24ebd770c40ee4d8996d1f40"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"194482363648532907574043945036591750697", "length":405}, "id":"ASB-A-505748392-55acb9bf", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/61053a062cdffc5c24ebd770c40ee4d8996d1f40", "target":{"file":"libs/androidfw/ZipFileRO.cpp", "function":"ZipFileRO::getEntryFileName"}}, {"deprecated":false, "digest":{"line_hashes":["217393691783784062743186263382289736587", "251243380099684899172006670758014669102", "160757615909430888168392578688260034243"], "threshold":0.9}, "id":"ASB-A-505748392-bf74907d", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/61053a062cdffc5c24ebd770c40ee4d8996d1f40", "target":{"file":"libs/androidfw/include/androidfw/ZipFileRO.h"}}, {"deprecated":false, "digest":{"line_hashes":["255273107764280999950999932921386056299", "200770063162390918579106892912898843566", "127628624804953613033083286504704442189", "10770843555836785776292486916865778428", "148386236082038627021727118362863878045", "229865868111145925047752915818625423152"], "threshold":0.9}, "id":"ASB-A-505748392-e3352ca9", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/61053a062cdffc5c24ebd770c40ee4d8996d1f40", "target":{"file":"libs/androidfw/ZipFileRO.cpp"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-11-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/5234b8c33e63286bdb382992acdcaa440da01be0"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["255273107764280999950999932921386056299", "200770063162390918579106892912898843566", "127628624804953613033083286504704442189", "10770843555836785776292486916865778428", "148386236082038627021727118362863878045", "229865868111145925047752915818625423152"], "threshold":0.9}, "id":"ASB-A-505748392-36b68b42", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/5234b8c33e63286bdb382992acdcaa440da01be0", "target":{"file":"libs/androidfw/ZipFileRO.cpp"}}, {"deprecated":false, "digest":{"line_hashes":["217393691783784062743186263382289736587", "251243380099684899172006670758014669102", "160757615909430888168392578688260034243"], "threshold":0.9}, "id":"ASB-A-505748392-3ed9d8ed", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/5234b8c33e63286bdb382992acdcaa440da01be0", "target":{"file":"libs/androidfw/include/androidfw/ZipFileRO.h"}}, {"deprecated":false, "digest":{"function_hash":"194482363648532907574043945036591750697", "length":405}, "id":"ASB-A-505748392-b8263e72", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/5234b8c33e63286bdb382992acdcaa440da01be0", "target":{"file":"libs/androidfw/ZipFileRO.cpp", "function":"ZipFileRO::getEntryFileName"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-11-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/46e98295d82f24f7f61fe38040a29521b036e7ea"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["255273107764280999950999932921386056299", "200770063162390918579106892912898843566", "127628624804953613033083286504704442189", "10770843555836785776292486916865778428", "148386236082038627021727118362863878045", "229865868111145925047752915818625423152"], "threshold":0.9}, "id":"ASB-A-505748392-6a233ecc", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/46e98295d82f24f7f61fe38040a29521b036e7ea", "target":{"file":"libs/androidfw/ZipFileRO.cpp"}}, {"deprecated":false, "digest":{"line_hashes":["217393691783784062743186263382289736587", "251243380099684899172006670758014669102", "160757615909430888168392578688260034243"], "threshold":0.9}, "id":"ASB-A-505748392-7577ff03", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/46e98295d82f24f7f61fe38040a29521b036e7ea", "target":{"file":"libs/androidfw/include/androidfw/ZipFileRO.h"}}, {"deprecated":false, "digest":{"function_hash":"194482363648532907574043945036591750697", "length":405}, "id":"ASB-A-505748392-d4dcb07e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/46e98295d82f24f7f61fe38040a29521b036e7ea", "target":{"file":"libs/androidfw/ZipFileRO.cpp", "function":"ZipFileRO::getEntryFileName"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-11-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/770a5c19cfaf537a57947f5f919cdca26e018eef"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"194482363648532907574043945036591750697", "length":405}, "id":"ASB-A-505748392-87cfb738", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/770a5c19cfaf537a57947f5f919cdca26e018eef", "target":{"file":"libs/androidfw/ZipFileRO.cpp", "function":"ZipFileRO::getEntryFileName"}}, {"deprecated":false, "digest":{"line_hashes":["255273107764280999950999932921386056299", "200770063162390918579106892912898843566", "127628624804953613033083286504704442189", "10770843555836785776292486916865778428", "148386236082038627021727118362863878045", "229865868111145925047752915818625423152"], "threshold":0.9}, "id":"ASB-A-505748392-b5c1d783", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/770a5c19cfaf537a57947f5f919cdca26e018eef", "target":{"file":"libs/androidfw/ZipFileRO.cpp"}}, {"deprecated":false, "digest":{"line_hashes":["217393691783784062743186263382289736587", "251243380099684899172006670758014669102", "160757615909430888168392578688260034243"], "threshold":0.9}, "id":"ASB-A-505748392-c4abb6ec", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/770a5c19cfaf537a57947f5f919cdca26e018eef", "target":{"file":"libs/androidfw/include/androidfw/ZipFileRO.h"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}