{"id":"ASB-A-513648011", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-05T16:32:28.703711716Z", "aliases":["CVE-2026-58997", "A-513648011"], "details":"In validateImageInfo of Bitmap.cpp, there is a possible out-of-bounds read due to a precondition check failure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/67ef036b9060552258b8caaf8e49c85f48da5db1"], "severity":"High", "spl":"2026-11-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["94654918781612247483811063862840027554", "296468792354559022205288119916364429658", "82871125724142472633236013785668441817", "180514944661552183187273550678361925403"], "threshold":0.9}, "id":"ASB-A-513648011-1575438c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/67ef036b9060552258b8caaf8e49c85f48da5db1", "target":{"file":"libs/hwui/jni/Bitmap.cpp"}}, {"deprecated":false, "digest":{"function_hash":"36288759716345442900506949170843387867", "length":113}, "id":"ASB-A-513648011-d954ffc9", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/67ef036b9060552258b8caaf8e49c85f48da5db1", "target":{"file":"libs/hwui/jni/Bitmap.cpp", "function":"validateImageInfo"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-11-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/58b07718174f5fd713ed5e2994a79294d8b5aa73"], "severity":"High", "spl":"2026-11-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"36288759716345442900506949170843387867", "length":113}, "id":"ASB-A-513648011-1a8b5a79", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/58b07718174f5fd713ed5e2994a79294d8b5aa73", "target":{"file":"libs/hwui/jni/Bitmap.cpp", "function":"validateImageInfo"}}, {"deprecated":false, "digest":{"line_hashes":["94654918781612247483811063862840027554", "296468792354559022205288119916364429658", "199826806362808061630851351955576283753", "149667207129454943059440100123040215073"], "threshold":0.9}, "id":"ASB-A-513648011-63aa54a6", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/58b07718174f5fd713ed5e2994a79294d8b5aa73", "target":{"file":"libs/hwui/jni/Bitmap.cpp"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-11-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/05f0ef4e67e5284d737b500472535ec2d41c761b"], "severity":"High", "spl":"2026-11-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["94654918781612247483811063862840027554", "296468792354559022205288119916364429658", "199826806362808061630851351955576283753", "208297895565310584332630736759101993744"], "threshold":0.9}, "id":"ASB-A-513648011-bf082045", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/05f0ef4e67e5284d737b500472535ec2d41c761b", "target":{"file":"libs/hwui/jni/Bitmap.cpp"}}, {"deprecated":false, "digest":{"function_hash":"36288759716345442900506949170843387867", "length":113}, "id":"ASB-A-513648011-fe6d6a04", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/05f0ef4e67e5284d737b500472535ec2d41c761b", "target":{"file":"libs/hwui/jni/Bitmap.cpp", "function":"validateImageInfo"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-11-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/a9ed7116bfdc6934bf074d839a98130840c32067"], "severity":"High", "spl":"2026-11-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["94654918781612247483811063862840027554", "296468792354559022205288119916364429658", "199826806362808061630851351955576283753", "208297895565310584332630736759101993744"], "threshold":0.9}, "id":"ASB-A-513648011-b6eca38a", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a9ed7116bfdc6934bf074d839a98130840c32067", "target":{"file":"libs/hwui/jni/Bitmap.cpp"}}, {"deprecated":false, "digest":{"function_hash":"36288759716345442900506949170843387867", "length":113}, "id":"ASB-A-513648011-f6f6a9d0", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a9ed7116bfdc6934bf074d839a98130840c32067", "target":{"file":"libs/hwui/jni/Bitmap.cpp", "function":"validateImageInfo"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-11-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/27d853381628772829e1a4fa68ac6507431d6eb6"], "severity":"High", "spl":"2026-11-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["94654918781612247483811063862840027554", "296468792354559022205288119916364429658", "199826806362808061630851351955576283753", "208297895565310584332630736759101993744"], "threshold":0.9}, "id":"ASB-A-513648011-74749f5a", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/27d853381628772829e1a4fa68ac6507431d6eb6", "target":{"file":"libs/hwui/jni/Bitmap.cpp"}}, {"deprecated":false, "digest":{"function_hash":"36288759716345442900506949170843387867", "length":113}, "id":"ASB-A-513648011-8ecc4442", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/27d853381628772829e1a4fa68ac6507431d6eb6", "target":{"file":"libs/hwui/jni/Bitmap.cpp", "function":"validateImageInfo"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-11-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/b7e3d69a5323ab48e1f7817aebea8f22ba345739"], "severity":"High", "spl":"2026-11-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["94654918781612247483811063862840027554", "296468792354559022205288119916364429658", "199826806362808061630851351955576283753", "149667207129454943059440100123040215073"], "threshold":0.9}, "id":"ASB-A-513648011-195dc26f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/b7e3d69a5323ab48e1f7817aebea8f22ba345739", "target":{"file":"libs/hwui/jni/Bitmap.cpp"}}, {"deprecated":false, "digest":{"function_hash":"36288759716345442900506949170843387867", "length":113}, "id":"ASB-A-513648011-23d03919", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/b7e3d69a5323ab48e1f7817aebea8f22ba345739", "target":{"file":"libs/hwui/jni/Bitmap.cpp", "function":"validateImageInfo"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}