{"id":"ASB-A-509980995", "published":"2026-10-01T00:00:00Z", "modified":"2026-10-06T15:36:24.859151902Z", "aliases":["CVE-2026-55266", "A-509980995"], "details":"In qsort of libufdt_sysdeps_vendor.c, there is a possible out-of-bounds write due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/system/libufdt", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-10-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/libufdt/+/df9856866b8d8b19058beb8e418c588cd47c60dc"], "severity":"High", "spl":"2026-10-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["137993797009395550428776651770291716163", "193965384120655580524755473377960841859", "200024504230025755980259680530302527962", "292652473577376386515723978346152089008", "313098299662800207090179405850625187848", "241194047026163989788690596247341648628", "281524713045533723474044076505175332651", "307296896859351763571935461447691248140", "265717812399586917900284566277803839097", "326808613316438876634975978328511266906", "323255847457112314371069404249604084910", "257766332763367307610507383215671412809", "240655166247386861863658649374348557277"], "threshold":0.9}, "id":"ASB-A-509980995-3812a1fa", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/libufdt/+/df9856866b8d8b19058beb8e418c588cd47c60dc", "target":{"file":"sysdeps/libufdt_sysdeps_vendor.c"}}, {"deprecated":false, "digest":{"function_hash":"38291949770363451779359671998067870011", "length":2162}, "id":"ASB-A-509980995-41fcb4e0", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/libufdt/+/df9856866b8d8b19058beb8e418c588cd47c60dc", "target":{"file":"sysdeps/libufdt_sysdeps_vendor.c", "function":"qsort"}}]}}, {"package":{"name":"platform/system/libufdt", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-10-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/libufdt/+/63a6e6fbe0722ef270f6e804a4a86c5f1afea68b"], "severity":"High", "spl":"2026-10-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["137993797009395550428776651770291716163", "193965384120655580524755473377960841859", "200024504230025755980259680530302527962", "292652473577376386515723978346152089008", "313098299662800207090179405850625187848", "241194047026163989788690596247341648628", "281524713045533723474044076505175332651", "307296896859351763571935461447691248140", "265717812399586917900284566277803839097", "326808613316438876634975978328511266906", "323255847457112314371069404249604084910", "257766332763367307610507383215671412809", "240655166247386861863658649374348557277"], "threshold":0.9}, "id":"ASB-A-509980995-83081fc3", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/libufdt/+/63a6e6fbe0722ef270f6e804a4a86c5f1afea68b", "target":{"file":"sysdeps/libufdt_sysdeps_vendor.c"}}, {"deprecated":false, "digest":{"function_hash":"38291949770363451779359671998067870011", "length":2162}, "id":"ASB-A-509980995-90eeccdf", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/libufdt/+/63a6e6fbe0722ef270f6e804a4a86c5f1afea68b", "target":{"file":"sysdeps/libufdt_sysdeps_vendor.c", "function":"qsort"}}]}}, {"package":{"name":"platform/system/libufdt", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-10-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/libufdt/+/3ddb2cd7727cc2b7d0f5b5330aadb93aa21943ba"], "severity":"High", "spl":"2026-10-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"38291949770363451779359671998067870011", "length":2162}, "id":"ASB-A-509980995-04daceab", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/libufdt/+/3ddb2cd7727cc2b7d0f5b5330aadb93aa21943ba", "target":{"file":"sysdeps/libufdt_sysdeps_vendor.c", "function":"qsort"}}, {"deprecated":false, "digest":{"line_hashes":["137993797009395550428776651770291716163", "193965384120655580524755473377960841859", "200024504230025755980259680530302527962", "292652473577376386515723978346152089008", "313098299662800207090179405850625187848", "241194047026163989788690596247341648628", "281524713045533723474044076505175332651", "307296896859351763571935461447691248140", "265717812399586917900284566277803839097", "326808613316438876634975978328511266906", "323255847457112314371069404249604084910", "257766332763367307610507383215671412809", "240655166247386861863658649374348557277"], "threshold":0.9}, "id":"ASB-A-509980995-5267d152", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/libufdt/+/3ddb2cd7727cc2b7d0f5b5330aadb93aa21943ba", "target":{"file":"sysdeps/libufdt_sysdeps_vendor.c"}}]}}, {"package":{"name":"platform/system/libufdt", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-10-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/libufdt/+/2de0d867217447eb281ee4fb775fa8a04d6f1b9a"], "severity":"High", "spl":"2026-10-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"38291949770363451779359671998067870011", "length":2162}, "id":"ASB-A-509980995-5f419eb5", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/libufdt/+/2de0d867217447eb281ee4fb775fa8a04d6f1b9a", "target":{"file":"sysdeps/libufdt_sysdeps_vendor.c", "function":"qsort"}}, {"deprecated":false, "digest":{"line_hashes":["137993797009395550428776651770291716163", "193965384120655580524755473377960841859", "200024504230025755980259680530302527962", "292652473577376386515723978346152089008", "313098299662800207090179405850625187848", "241194047026163989788690596247341648628", "281524713045533723474044076505175332651", "307296896859351763571935461447691248140", "265717812399586917900284566277803839097", "326808613316438876634975978328511266906", "323255847457112314371069404249604084910", "257766332763367307610507383215671412809", "240655166247386861863658649374348557277"], "threshold":0.9}, "id":"ASB-A-509980995-e75a06cf", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/libufdt/+/2de0d867217447eb281ee4fb775fa8a04d6f1b9a", "target":{"file":"sysdeps/libufdt_sysdeps_vendor.c"}}]}}, {"package":{"name":"platform/system/libufdt", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-10-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/libufdt/+/90b1784cced8f5d1834a87dbf6fa8e1e74ef5448"], "severity":"High", "spl":"2026-10-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"38291949770363451779359671998067870011", "length":2162}, "id":"ASB-A-509980995-47019493", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/libufdt/+/90b1784cced8f5d1834a87dbf6fa8e1e74ef5448", "target":{"file":"sysdeps/libufdt_sysdeps_vendor.c", "function":"qsort"}}, {"deprecated":false, "digest":{"line_hashes":["137993797009395550428776651770291716163", "193965384120655580524755473377960841859", "200024504230025755980259680530302527962", "292652473577376386515723978346152089008", "313098299662800207090179405850625187848", "241194047026163989788690596247341648628", "281524713045533723474044076505175332651", "307296896859351763571935461447691248140", "265717812399586917900284566277803839097", "326808613316438876634975978328511266906", "323255847457112314371069404249604084910", "257766332763367307610507383215671412809", "240655166247386861863658649374348557277"], "threshold":0.9}, "id":"ASB-A-509980995-50165515", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/libufdt/+/90b1784cced8f5d1834a87dbf6fa8e1e74ef5448", "target":{"file":"sysdeps/libufdt_sysdeps_vendor.c"}}]}}, {"package":{"name":"platform/system/libufdt", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-10-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/libufdt/+/72740bf01100c7cbd40e1d0fc9e25c17c5a60be0"], "severity":"High", "spl":"2026-10-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["137993797009395550428776651770291716163", "193965384120655580524755473377960841859", "200024504230025755980259680530302527962", "292652473577376386515723978346152089008", "313098299662800207090179405850625187848", "241194047026163989788690596247341648628", "281524713045533723474044076505175332651", "307296896859351763571935461447691248140", "265717812399586917900284566277803839097", "326808613316438876634975978328511266906", "323255847457112314371069404249604084910", "257766332763367307610507383215671412809", "240655166247386861863658649374348557277"], "threshold":0.9}, "id":"ASB-A-509980995-0ce7ad58", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/libufdt/+/72740bf01100c7cbd40e1d0fc9e25c17c5a60be0", "target":{"file":"sysdeps/libufdt_sysdeps_vendor.c"}}, {"deprecated":false, "digest":{"function_hash":"38291949770363451779359671998067870011", "length":2162}, "id":"ASB-A-509980995-d8bc2ef7", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/libufdt/+/72740bf01100c7cbd40e1d0fc9e25c17c5a60be0", "target":{"file":"sysdeps/libufdt_sysdeps_vendor.c", "function":"qsort"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-10-01"}]}