{"id":"ASB-A-506109174", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-10T15:43:18.983809180Z", "aliases":["CVE-2026-58822", "A-506109174"], "details":"In multiple functions of ftsmooth.c, there is a possible memory safety issue due to improper casting. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/external/freetype", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/freetype/+/3256955df2f9e2f2743603f6a6fc637d1a862fc6"], "severity":"High", "spl":"2026-09-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["146622831831300144023853238563881627470", "56388942065459399236012205610290285822", "292397237868389660909710518098158009447", "219570866647328190243318567981960414297", "62029007458789907284789031892908044626", "286912871915672633602449500751706356632"], "threshold":0.9}, "id":"ASB-A-506109174-986c5bed", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/3256955df2f9e2f2743603f6a6fc637d1a862fc6", "target":{"file":"src/smooth/ftsmooth.c"}}, {"deprecated":false, "digest":{"function_hash":"102182539091905126291391522742479090802", "length":1151}, "id":"ASB-A-506109174-df78e86d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/3256955df2f9e2f2743603f6a6fc637d1a862fc6", "target":{"file":"src/smooth/ftsmooth.c", "function":"ft_smooth_raster_lcdv"}}, {"deprecated":false, "digest":{"function_hash":"215417419846574874227165714915549114949", "length":1366}, "id":"ASB-A-506109174-e824a576", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/3256955df2f9e2f2743603f6a6fc637d1a862fc6", "target":{"file":"src/smooth/ftsmooth.c", "function":"ft_smooth_raster_lcd"}}]}}, {"package":{"name":"platform/external/freetype", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-09-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/freetype/+/d6d8fdf7c235cd52b53106fcd04078dd281f5ea9"], "severity":"High", "spl":"2026-09-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"102182539091905126291391522742479090802", "length":1151}, "id":"ASB-A-506109174-02dfa03a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/d6d8fdf7c235cd52b53106fcd04078dd281f5ea9", "target":{"file":"src/smooth/ftsmooth.c", "function":"ft_smooth_raster_lcdv"}}, {"deprecated":false, "digest":{"line_hashes":["146622831831300144023853238563881627470", "56388942065459399236012205610290285822", "292397237868389660909710518098158009447", "219570866647328190243318567981960414297", "62029007458789907284789031892908044626", "286912871915672633602449500751706356632"], "threshold":0.9}, "id":"ASB-A-506109174-b91e4828", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/d6d8fdf7c235cd52b53106fcd04078dd281f5ea9", "target":{"file":"src/smooth/ftsmooth.c"}}, {"deprecated":false, "digest":{"function_hash":"215417419846574874227165714915549114949", "length":1366}, "id":"ASB-A-506109174-bed7954f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/d6d8fdf7c235cd52b53106fcd04078dd281f5ea9", "target":{"file":"src/smooth/ftsmooth.c", "function":"ft_smooth_raster_lcd"}}]}}, {"package":{"name":"platform/external/freetype", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/freetype/+/2e80dfa7aa277523ef8a46e827a1be531b75702e"], "severity":"High", "spl":"2026-09-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"102182539091905126291391522742479090802", "length":1151}, "id":"ASB-A-506109174-19f79e02", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/2e80dfa7aa277523ef8a46e827a1be531b75702e", "target":{"file":"src/smooth/ftsmooth.c", "function":"ft_smooth_raster_lcdv"}}, {"deprecated":false, "digest":{"function_hash":"215417419846574874227165714915549114949", "length":1366}, "id":"ASB-A-506109174-4d9e65fb", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/2e80dfa7aa277523ef8a46e827a1be531b75702e", "target":{"file":"src/smooth/ftsmooth.c", "function":"ft_smooth_raster_lcd"}}, {"deprecated":false, "digest":{"line_hashes":["146622831831300144023853238563881627470", "56388942065459399236012205610290285822", "292397237868389660909710518098158009447", "219570866647328190243318567981960414297", "62029007458789907284789031892908044626", "286912871915672633602449500751706356632"], "threshold":0.9}, "id":"ASB-A-506109174-6846f0b7", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/2e80dfa7aa277523ef8a46e827a1be531b75702e", "target":{"file":"src/smooth/ftsmooth.c"}}]}}, {"package":{"name":"platform/external/freetype", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/freetype/+/21992c2fe17764cc0a0cda2428a888e075a37ddc"], "severity":"High", "spl":"2026-09-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["146622831831300144023853238563881627470", "56388942065459399236012205610290285822", "292397237868389660909710518098158009447", "219570866647328190243318567981960414297", "62029007458789907284789031892908044626", "286912871915672633602449500751706356632"], "threshold":0.9}, "id":"ASB-A-506109174-5d213baf", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/21992c2fe17764cc0a0cda2428a888e075a37ddc", "target":{"file":"src/smooth/ftsmooth.c"}}, {"deprecated":false, "digest":{"function_hash":"102182539091905126291391522742479090802", "length":1151}, "id":"ASB-A-506109174-824d82e9", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/21992c2fe17764cc0a0cda2428a888e075a37ddc", "target":{"file":"src/smooth/ftsmooth.c", "function":"ft_smooth_raster_lcdv"}}, {"deprecated":false, "digest":{"function_hash":"215417419846574874227165714915549114949", "length":1366}, "id":"ASB-A-506109174-d2306c77", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/21992c2fe17764cc0a0cda2428a888e075a37ddc", "target":{"file":"src/smooth/ftsmooth.c", "function":"ft_smooth_raster_lcd"}}]}}, {"package":{"name":"platform/external/freetype", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/freetype/+/0c28569cac9bf57a3b7cf57f87bdeae4d779ec36"], "severity":"High", "spl":"2026-09-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"215417419846574874227165714915549114949", "length":1366}, "id":"ASB-A-506109174-8288a785", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/0c28569cac9bf57a3b7cf57f87bdeae4d779ec36", "target":{"file":"src/smooth/ftsmooth.c", "function":"ft_smooth_raster_lcd"}}, {"deprecated":false, "digest":{"line_hashes":["146622831831300144023853238563881627470", "56388942065459399236012205610290285822", "292397237868389660909710518098158009447", "219570866647328190243318567981960414297", "62029007458789907284789031892908044626", "286912871915672633602449500751706356632"], "threshold":0.9}, "id":"ASB-A-506109174-837c112b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/0c28569cac9bf57a3b7cf57f87bdeae4d779ec36", "target":{"file":"src/smooth/ftsmooth.c"}}, {"deprecated":false, "digest":{"function_hash":"102182539091905126291391522742479090802", "length":1151}, "id":"ASB-A-506109174-d6e1c442", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/0c28569cac9bf57a3b7cf57f87bdeae4d779ec36", "target":{"file":"src/smooth/ftsmooth.c", "function":"ft_smooth_raster_lcdv"}}]}}, {"package":{"name":"platform/external/freetype", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-09-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/freetype/+/c147b243ef5a603bb0bb3fcf89c6059ce367f654"], "severity":"High", "spl":"2026-09-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["146622831831300144023853238563881627470", "56388942065459399236012205610290285822", "249031127780233373682035083758657469812", "219570866647328190243318567981960414297", "62029007458789907284789031892908044626", "286912871915672633602449500751706356632"], "threshold":0.9}, "id":"ASB-A-506109174-0d9428f2", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/c147b243ef5a603bb0bb3fcf89c6059ce367f654", "target":{"file":"src/smooth/ftsmooth.c"}}, {"deprecated":false, "digest":{"function_hash":"102182539091905126291391522742479090802", "length":1151}, "id":"ASB-A-506109174-829efef4", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/c147b243ef5a603bb0bb3fcf89c6059ce367f654", "target":{"file":"src/smooth/ftsmooth.c", "function":"ft_smooth_raster_lcdv"}}, {"deprecated":false, "digest":{"function_hash":"98745190088134440164957985237078224192", "length":1376}, "id":"ASB-A-506109174-8cb1a341", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/freetype/+/c147b243ef5a603bb0bb3fcf89c6059ce367f654", "target":{"file":"src/smooth/ftsmooth.c", "function":"ft_smooth_raster_lcd"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}