{"id":"ASB-A-511640905", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-16T15:47:14.630094689Z", "aliases":["CVE-2026-49927", "A-511640905"], "details":"In multiple locations, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/external/libppd", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/libppd/+/6a68ec5827c47b489ad6c0d618539a03b6c4a030"], "severity":"Critical", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["44962297997072222622375396097813682821", "164264004405122618038050854423345254234", "6778137727039842854886473269356173672", "265755248766355260897528772220591114886", "132712056677079736849410988621362333101", "317590831915478151555486627880931226573", "149140458925552025632630900349852288683", "83449300026991262329504972378475761730", "143041578655113405103429180972162157138", "305407763440932820003256330882568300067", "93479294958980798401718299045807293476", "259361055327899273627568293976031866903", "28485716057795232161982779768457807622", "274389170064040651359436879652360415622", "200019564112221352489723085804787941301", "248844137173347591191974375237355852261", "137891444674319826360103050437204065963", "73261245257832340828033198585741960517", "93750584975079018549646025536301152369", "44226574710248510626374563691948921313", "140750894555880093206577899356388436349", "185124880526862421682510845869896189112", "314024136004694084723184536256454606040", "140996258581963537661696372929836892819", "174046961242012198480516570854247799696", "95834746310349108125722994501444863453", "150150234466187364348703924722998157182", "1636238584027049840760210053154007782", "269614017045588465491934725569401917228", "192892397163153819810535910386765109387", "272505493988343909666026694431948221700", "180040678522464252556605713786681660192", "244816998064406296735488648170330871125", "84671068386367939730233034188605699686", "293335696134146982172153782793267851768", "245228774914010555778037437050731198498", "215163055808463799818651579089071589573", "26629796998428145775479357615050466741", "17753640040339776529073322611258009608", "188885668344785179899624334907766438179", "89835156156898083904384321607776812323", "157669049970530960895958433281264304328", "13183011660932568516168525724752344213", "266908730079764000691795393790786324496", "32916890398679569823925043279563207625"], "threshold":0.9}, "id":"ASB-A-511640905-32cfc4bc", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libppd/+/6a68ec5827c47b489ad6c0d618539a03b6c4a030", "target":{"file":"ppd/rastertops.c"}}, {"deprecated":false, "digest":{"function_hash":"270111412181754467997058809460146568783", "length":7487}, "id":"ASB-A-511640905-a653dc96", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libppd/+/6a68ec5827c47b489ad6c0d618539a03b6c4a030", "target":{"file":"ppd/raster-interpret.c", "function":"ppdRasterInterpretPPD"}}, {"deprecated":false, "digest":{"line_hashes":["228884931509736023321532316863439408865", "245512546130279032922794780264240231926", "298283364229518929812621197046250507758", "153326455306784906433253102389338208927", "183137496727969299268926065148625726746", "245800676463951503304064034439803017611", "267216177946666879378796459637149344341", "302150254281362373215589120753786553116", "56128546118176275440813259845577860822", "221130564534015479928979479905761480630"], "threshold":0.9}, "id":"ASB-A-511640905-b3b59ea7", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libppd/+/6a68ec5827c47b489ad6c0d618539a03b6c4a030", "target":{"file":"ppd/raster-interpret.c"}}, {"deprecated":false, "digest":{"function_hash":"112084852496166372237690221632010885140", "length":1693}, "id":"ASB-A-511640905-da3dfc1c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libppd/+/6a68ec5827c47b489ad6c0d618539a03b6c4a030", "target":{"file":"ppd/rastertops.c", "function":"write_flate"}}]}}, {"package":{"name":"platform/external/libppd", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/libppd/+/b7ce2bd04ef6f88695677d700b4e2fd2385eebff"], "severity":"Critical", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"112084852496166372237690221632010885140", "length":1693}, "id":"ASB-A-511640905-03a81e14", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libppd/+/b7ce2bd04ef6f88695677d700b4e2fd2385eebff", "target":{"file":"ppd/rastertops.c", "function":"write_flate"}}, {"deprecated":false, "digest":{"line_hashes":["228884931509736023321532316863439408865", "245512546130279032922794780264240231926", "298283364229518929812621197046250507758", "153326455306784906433253102389338208927", "183137496727969299268926065148625726746", "245800676463951503304064034439803017611", "267216177946666879378796459637149344341", "302150254281362373215589120753786553116", "56128546118176275440813259845577860822", "221130564534015479928979479905761480630"], "threshold":0.9}, "id":"ASB-A-511640905-5a28587a", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libppd/+/b7ce2bd04ef6f88695677d700b4e2fd2385eebff", "target":{"file":"ppd/raster-interpret.c"}}, {"deprecated":false, "digest":{"function_hash":"270111412181754467997058809460146568783", "length":7487}, "id":"ASB-A-511640905-b11f0dea", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libppd/+/b7ce2bd04ef6f88695677d700b4e2fd2385eebff", "target":{"file":"ppd/raster-interpret.c", "function":"ppdRasterInterpretPPD"}}, {"deprecated":false, "digest":{"line_hashes":["44962297997072222622375396097813682821", "164264004405122618038050854423345254234", "6778137727039842854886473269356173672", "265755248766355260897528772220591114886", "132712056677079736849410988621362333101", "317590831915478151555486627880931226573", "149140458925552025632630900349852288683", "83449300026991262329504972378475761730", "143041578655113405103429180972162157138", "305407763440932820003256330882568300067", "93479294958980798401718299045807293476", "259361055327899273627568293976031866903", "28485716057795232161982779768457807622", "274389170064040651359436879652360415622", "200019564112221352489723085804787941301", "248844137173347591191974375237355852261", "137891444674319826360103050437204065963", "73261245257832340828033198585741960517", "93750584975079018549646025536301152369", "44226574710248510626374563691948921313", "140750894555880093206577899356388436349", "185124880526862421682510845869896189112", "314024136004694084723184536256454606040", "140996258581963537661696372929836892819", "174046961242012198480516570854247799696", "95834746310349108125722994501444863453", "150150234466187364348703924722998157182", "1636238584027049840760210053154007782", "269614017045588465491934725569401917228", "192892397163153819810535910386765109387", "272505493988343909666026694431948221700", "180040678522464252556605713786681660192", "244816998064406296735488648170330871125", "84671068386367939730233034188605699686", "293335696134146982172153782793267851768", "245228774914010555778037437050731198498", "215163055808463799818651579089071589573", "26629796998428145775479357615050466741", "17753640040339776529073322611258009608", "188885668344785179899624334907766438179", "89835156156898083904384321607776812323", "157669049970530960895958433281264304328", "13183011660932568516168525724752344213", "266908730079764000691795393790786324496", "32916890398679569823925043279563207625"], "threshold":0.9}, "id":"ASB-A-511640905-c21674f6", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libppd/+/b7ce2bd04ef6f88695677d700b4e2fd2385eebff", "target":{"file":"ppd/rastertops.c"}}]}}, {"package":{"name":"platform/external/libppd", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/libppd/+/000552a27da68d87c1151ea00d06b82cd0a06a07"], "severity":"Critical", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["228884931509736023321532316863439408865", "245512546130279032922794780264240231926", "298283364229518929812621197046250507758", "153326455306784906433253102389338208927", "183137496727969299268926065148625726746", "245800676463951503304064034439803017611", "267216177946666879378796459637149344341", "302150254281362373215589120753786553116", "56128546118176275440813259845577860822", "221130564534015479928979479905761480630"], "threshold":0.9}, "id":"ASB-A-511640905-2142a534", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libppd/+/000552a27da68d87c1151ea00d06b82cd0a06a07", "target":{"file":"ppd/raster-interpret.c"}}, {"deprecated":false, "digest":{"function_hash":"270111412181754467997058809460146568783", "length":7487}, "id":"ASB-A-511640905-80c894a6", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libppd/+/000552a27da68d87c1151ea00d06b82cd0a06a07", "target":{"file":"ppd/raster-interpret.c", "function":"ppdRasterInterpretPPD"}}, {"deprecated":false, "digest":{"line_hashes":["44962297997072222622375396097813682821", "164264004405122618038050854423345254234", "6778137727039842854886473269356173672", "265755248766355260897528772220591114886", "132712056677079736849410988621362333101", "317590831915478151555486627880931226573", "149140458925552025632630900349852288683", "83449300026991262329504972378475761730", "143041578655113405103429180972162157138", "305407763440932820003256330882568300067", "93479294958980798401718299045807293476", "259361055327899273627568293976031866903", "28485716057795232161982779768457807622", "274389170064040651359436879652360415622", "200019564112221352489723085804787941301", "248844137173347591191974375237355852261", "137891444674319826360103050437204065963", "73261245257832340828033198585741960517", "93750584975079018549646025536301152369", "44226574710248510626374563691948921313", "140750894555880093206577899356388436349", "185124880526862421682510845869896189112", "314024136004694084723184536256454606040", "140996258581963537661696372929836892819", "174046961242012198480516570854247799696", "95834746310349108125722994501444863453", "150150234466187364348703924722998157182", "1636238584027049840760210053154007782", "269614017045588465491934725569401917228", "192892397163153819810535910386765109387", "272505493988343909666026694431948221700", "180040678522464252556605713786681660192", "244816998064406296735488648170330871125", "84671068386367939730233034188605699686", "293335696134146982172153782793267851768", "245228774914010555778037437050731198498", "215163055808463799818651579089071589573", "26629796998428145775479357615050466741", "17753640040339776529073322611258009608", "188885668344785179899624334907766438179", "89835156156898083904384321607776812323", "157669049970530960895958433281264304328", "13183011660932568516168525724752344213", "266908730079764000691795393790786324496", "32916890398679569823925043279563207625"], "threshold":0.9}, "id":"ASB-A-511640905-b62860d8", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libppd/+/000552a27da68d87c1151ea00d06b82cd0a06a07", "target":{"file":"ppd/rastertops.c"}}, {"deprecated":false, "digest":{"function_hash":"112084852496166372237690221632010885140", "length":1693}, "id":"ASB-A-511640905-ce94a607", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libppd/+/000552a27da68d87c1151ea00d06b82cd0a06a07", "target":{"file":"ppd/rastertops.c", "function":"write_flate"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/external/libppd/+/6ce8492f2566a35e79afd0f159be7acebe124863"}]}