{"id":"ASB-A-511821731", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-10T15:43:18.983809180Z", "aliases":["CVE-2026-49918", "A-511821731"], "details":"In multiple functions, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/external/libcupsfilters", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/libcupsfilters/+/600ee202819ff619ffef4069a7d6e6d862828442"], "severity":"Critical", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"172705240091654816194339972220987382698", "length":22064}, "id":"ASB-A-511821731-1b8dd9d6", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libcupsfilters/+/600ee202819ff619ffef4069a7d6e6d862828442", "target":{"file":"cupsfilters/pwgtoraster.c", "function":"out_page"}}, {"deprecated":false, "digest":{"function_hash":"218494290827324000524534858525851077403", "length":4354}, "id":"ASB-A-511821731-49540be2", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libcupsfilters/+/600ee202819ff619ffef4069a7d6e6d862828442", "target":{"file":"cupsfilters/raster.c", "function":"cfRasterSetColorSpace"}}, {"deprecated":false, "digest":{"line_hashes":["286940995536061256983145668487887787651", "318220239952617257761236513284780622886", "202219165910144910497813257208064243548", "72653656246086581489608105542568454275", "209821297468708834973088056455793085322", "195679268196383995658288004172319765350", "214739178074388982758888013915096500970", "288342305341793160895383886500118700436", "52912204216922154796669925998757613786", "100128110123076449840968165065788450049", "310095948672532923181791016448010128981", "10127626629076048357499429208984340238"], "threshold":0.9}, "id":"ASB-A-511821731-5572e4c4", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libcupsfilters/+/600ee202819ff619ffef4069a7d6e6d862828442", "target":{"file":"cupsfilters/imagetoraster.c"}}, {"deprecated":false, "digest":{"function_hash":"211746030216377734068515634714422645364", "length":34521}, "id":"ASB-A-511821731-5944166e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libcupsfilters/+/600ee202819ff619ffef4069a7d6e6d862828442", "target":{"file":"cupsfilters/imagetoraster.c", "function":"cfFilterImageToRaster"}}, {"deprecated":false, "digest":{"line_hashes":["161241050013221359755585750190350435863", "238582997695624812398804282979072694453", "276770579587674945528883835642063197049", "295089443801985902631088399088231462227", "38233012377960220329291081884831524521", "244805454899891787808497418112865386197", "267216177946666879378796459637149344341", "259317987099181773195073738187220661665", "276861560703538767704438271873635403297", "314818333577706886505071975165005060623", "32488104705338724253832824120331890430", "10687573512176674227931654520934871037", "34262976792819183423771610384720266791", "246168895429023874844374306159037577508"], "threshold":0.9}, "id":"ASB-A-511821731-6c3f9d08", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libcupsfilters/+/600ee202819ff619ffef4069a7d6e6d862828442", "target":{"file":"cupsfilters/raster.c"}}, {"deprecated":false, "digest":{"function_hash":"78632532774089528210682218911866643198", "length":8856}, "id":"ASB-A-511821731-7a17259e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libcupsfilters/+/600ee202819ff619ffef4069a7d6e6d862828442", "target":{"file":"cupsfilters/raster.c", "function":"cfRasterPrepareHeader"}}, {"deprecated":false, "digest":{"line_hashes":["194688416331460594059850966744319048865", "99521633175145743581345027265443436456", "274177674319848221523929278457349215339", "125599779384998519713479716427037945753", "42667796877492303003724735429559672540", "328452854945950543944068166415048994679", "105202030296060485647442823907743140909", "290119733626958793342019246787541235924", "74072657954959684236831719648795509024", "229088568190036877637494090296413999920", "197807550229866634022707230437113502537", "197033632275660922140636361588951718595", "94794485793257313546952911180345156054", "222850179697902734554667014743580142020", "148427668034168565904590801122716057617", "116847087958116398701314944373351306450", "321931183811313153438182131798355540600", "165926653925939523833954265112784728381", "65176989134890647788006298159697629023", "156265450427090533925538750202601242065", "272698594400961572022788731351909216328", "213769534540087836018725912930404937664", "5202803568972068895178330979810482352", "230964298219163379532665575882003784131", "274086140779684201830788367308011801041", "869400991638176892740081911389680037", "189454774142254224369186181617260827338", "145708620872850408291412201693490204459", "7977479934805283073504897274264880071", "249093226241003640409869680895022752368", "20893685742284800828431230082724373842", "68451184621633938766353389324439018050", "339177316258991224642174700564301512535", "322874952593877061746510742146596316311", "329887434476946315496425679925197260342", "11071285130998237968531405777899222857", "267510906415411870718331994243597614474", "7698242634051921879943938466279585589", "184670659250061083878604554480312841566", "161906499956140636648793089169153436000", "278439185250133688919766383885486699601", "318119147717870644354838129295755522309"], "threshold":0.9}, "id":"ASB-A-511821731-a8e92ee0", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libcupsfilters/+/600ee202819ff619ffef4069a7d6e6d862828442", "target":{"file":"cupsfilters/pwgtoraster.c"}}]}}, {"package":{"name":"platform/external/libcupsfilters", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/libcupsfilters/+/f5245758e156c04c7adb0bea019b7311de00453a"], "severity":"Critical", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"218494290827324000524534858525851077403", "length":4354}, "id":"ASB-A-511821731-61341319", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libcupsfilters/+/f5245758e156c04c7adb0bea019b7311de00453a", "target":{"file":"cupsfilters/raster.c", "function":"cfRasterSetColorSpace"}}, {"deprecated":false, "digest":{"function_hash":"172705240091654816194339972220987382698", "length":22064}, "id":"ASB-A-511821731-6e426780", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libcupsfilters/+/f5245758e156c04c7adb0bea019b7311de00453a", "target":{"file":"cupsfilters/pwgtoraster.c", "function":"out_page"}}, {"deprecated":false, "digest":{"line_hashes":["286940995536061256983145668487887787651", "318220239952617257761236513284780622886", "202219165910144910497813257208064243548", "72653656246086581489608105542568454275", "209821297468708834973088056455793085322", "195679268196383995658288004172319765350", "214739178074388982758888013915096500970", "288342305341793160895383886500118700436", "52912204216922154796669925998757613786", "100128110123076449840968165065788450049", "310095948672532923181791016448010128981", "10127626629076048357499429208984340238"], "threshold":0.9}, "id":"ASB-A-511821731-83121690", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libcupsfilters/+/f5245758e156c04c7adb0bea019b7311de00453a", "target":{"file":"cupsfilters/imagetoraster.c"}}, {"deprecated":false, "digest":{"line_hashes":["194688416331460594059850966744319048865", "99521633175145743581345027265443436456", "274177674319848221523929278457349215339", "125599779384998519713479716427037945753", "42667796877492303003724735429559672540", "328452854945950543944068166415048994679", "105202030296060485647442823907743140909", "290119733626958793342019246787541235924", "74072657954959684236831719648795509024", "229088568190036877637494090296413999920", "197807550229866634022707230437113502537", "197033632275660922140636361588951718595", "94794485793257313546952911180345156054", "222850179697902734554667014743580142020", "148427668034168565904590801122716057617", "116847087958116398701314944373351306450", "321931183811313153438182131798355540600", "165926653925939523833954265112784728381", "65176989134890647788006298159697629023", "156265450427090533925538750202601242065", "272698594400961572022788731351909216328", "213769534540087836018725912930404937664", "5202803568972068895178330979810482352", "230964298219163379532665575882003784131", "274086140779684201830788367308011801041", "869400991638176892740081911389680037", "189454774142254224369186181617260827338", "145708620872850408291412201693490204459", "7977479934805283073504897274264880071", "249093226241003640409869680895022752368", "20893685742284800828431230082724373842", "68451184621633938766353389324439018050", "339177316258991224642174700564301512535", "322874952593877061746510742146596316311", "329887434476946315496425679925197260342", "11071285130998237968531405777899222857", "267510906415411870718331994243597614474", "7698242634051921879943938466279585589", "184670659250061083878604554480312841566", "161906499956140636648793089169153436000", "278439185250133688919766383885486699601", "318119147717870644354838129295755522309"], "threshold":0.9}, "id":"ASB-A-511821731-8c1295db", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libcupsfilters/+/f5245758e156c04c7adb0bea019b7311de00453a", "target":{"file":"cupsfilters/pwgtoraster.c"}}, {"deprecated":false, "digest":{"function_hash":"211746030216377734068515634714422645364", "length":34521}, "id":"ASB-A-511821731-b4466114", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libcupsfilters/+/f5245758e156c04c7adb0bea019b7311de00453a", "target":{"file":"cupsfilters/imagetoraster.c", "function":"cfFilterImageToRaster"}}, {"deprecated":false, "digest":{"function_hash":"78632532774089528210682218911866643198", "length":8856}, "id":"ASB-A-511821731-e1b7ab95", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libcupsfilters/+/f5245758e156c04c7adb0bea019b7311de00453a", "target":{"file":"cupsfilters/raster.c", "function":"cfRasterPrepareHeader"}}, {"deprecated":false, "digest":{"line_hashes":["161241050013221359755585750190350435863", "238582997695624812398804282979072694453", "276770579587674945528883835642063197049", "295089443801985902631088399088231462227", "38233012377960220329291081884831524521", "244805454899891787808497418112865386197", "267216177946666879378796459637149344341", "259317987099181773195073738187220661665", "276861560703538767704438271873635403297", "314818333577706886505071975165005060623", "32488104705338724253832824120331890430", "10687573512176674227931654520934871037", "34262976792819183423771610384720266791", "246168895429023874844374306159037577508"], "threshold":0.9}, "id":"ASB-A-511821731-f12fabcb", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libcupsfilters/+/f5245758e156c04c7adb0bea019b7311de00453a", "target":{"file":"cupsfilters/raster.c"}}]}}, {"package":{"name":"platform/external/libcupsfilters", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/libcupsfilters/+/0af6641e33600b19020356f4e834c303b3f63071"], "severity":"Critical", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"218494290827324000524534858525851077403", "length":4354}, "id":"ASB-A-511821731-2e72ae18", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libcupsfilters/+/0af6641e33600b19020356f4e834c303b3f63071", "target":{"file":"cupsfilters/raster.c", "function":"cfRasterSetColorSpace"}}, {"deprecated":false, "digest":{"line_hashes":["286940995536061256983145668487887787651", "318220239952617257761236513284780622886", "202219165910144910497813257208064243548", "72653656246086581489608105542568454275", "209821297468708834973088056455793085322", "195679268196383995658288004172319765350", "214739178074388982758888013915096500970", "288342305341793160895383886500118700436", "52912204216922154796669925998757613786", "100128110123076449840968165065788450049", "310095948672532923181791016448010128981", "10127626629076048357499429208984340238"], "threshold":0.9}, "id":"ASB-A-511821731-30639559", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libcupsfilters/+/0af6641e33600b19020356f4e834c303b3f63071", "target":{"file":"cupsfilters/imagetoraster.c"}}, {"deprecated":false, "digest":{"function_hash":"211746030216377734068515634714422645364", "length":34521}, "id":"ASB-A-511821731-51f813f1", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libcupsfilters/+/0af6641e33600b19020356f4e834c303b3f63071", "target":{"file":"cupsfilters/imagetoraster.c", "function":"cfFilterImageToRaster"}}, {"deprecated":false, "digest":{"function_hash":"172705240091654816194339972220987382698", "length":22064}, "id":"ASB-A-511821731-543327cd", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libcupsfilters/+/0af6641e33600b19020356f4e834c303b3f63071", "target":{"file":"cupsfilters/pwgtoraster.c", "function":"out_page"}}, {"deprecated":false, "digest":{"line_hashes":["194688416331460594059850966744319048865", "99521633175145743581345027265443436456", "274177674319848221523929278457349215339", "125599779384998519713479716427037945753", "42667796877492303003724735429559672540", "328452854945950543944068166415048994679", "105202030296060485647442823907743140909", "290119733626958793342019246787541235924", "74072657954959684236831719648795509024", "229088568190036877637494090296413999920", "197807550229866634022707230437113502537", "197033632275660922140636361588951718595", "94794485793257313546952911180345156054", "222850179697902734554667014743580142020", "148427668034168565904590801122716057617", "116847087958116398701314944373351306450", "321931183811313153438182131798355540600", "165926653925939523833954265112784728381", "65176989134890647788006298159697629023", "156265450427090533925538750202601242065", "272698594400961572022788731351909216328", "213769534540087836018725912930404937664", "5202803568972068895178330979810482352", "230964298219163379532665575882003784131", "274086140779684201830788367308011801041", "869400991638176892740081911389680037", "189454774142254224369186181617260827338", "145708620872850408291412201693490204459", "7977479934805283073504897274264880071", "249093226241003640409869680895022752368", "20893685742284800828431230082724373842", "68451184621633938766353389324439018050", "339177316258991224642174700564301512535", "322874952593877061746510742146596316311", "329887434476946315496425679925197260342", "11071285130998237968531405777899222857", "267510906415411870718331994243597614474", "7698242634051921879943938466279585589", "184670659250061083878604554480312841566", "161906499956140636648793089169153436000", "278439185250133688919766383885486699601", "318119147717870644354838129295755522309"], "threshold":0.9}, "id":"ASB-A-511821731-8db7536d", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libcupsfilters/+/0af6641e33600b19020356f4e834c303b3f63071", "target":{"file":"cupsfilters/pwgtoraster.c"}}, {"deprecated":false, "digest":{"function_hash":"78632532774089528210682218911866643198", "length":8856}, "id":"ASB-A-511821731-8f1d6085", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libcupsfilters/+/0af6641e33600b19020356f4e834c303b3f63071", "target":{"file":"cupsfilters/raster.c", "function":"cfRasterPrepareHeader"}}, {"deprecated":false, "digest":{"line_hashes":["161241050013221359755585750190350435863", "238582997695624812398804282979072694453", "276770579587674945528883835642063197049", "295089443801985902631088399088231462227", "38233012377960220329291081884831524521", "244805454899891787808497418112865386197", "267216177946666879378796459637149344341", "259317987099181773195073738187220661665", "276861560703538767704438271873635403297", "314818333577706886505071975165005060623", "32488104705338724253832824120331890430", "10687573512176674227931654520934871037", "34262976792819183423771610384720266791", "246168895429023874844374306159037577508"], "threshold":0.9}, "id":"ASB-A-511821731-b16b911a", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libcupsfilters/+/0af6641e33600b19020356f4e834c303b3f63071", "target":{"file":"cupsfilters/raster.c"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}