{"id":"ASB-A-514738229", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-02T16:38:00.081625681Z", "aliases":["CVE-2026-58986", "A-514738229"], "details":"In notifyPictureProfileHandleSelection of MediaQualityService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/f4f0ab21d45103fc84af4486238418fb95be0544"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["324357658243432102337756445572544309746", "152448830456879685040101109300635562693", "238301552452070931647990386623762264068", "149217687815167875097572085584169471977", "196458918112961924860740311398615060283", "122579940017490563447006472107366121299", "60059473715830813855892024481556283171", "181893847494795107251497306910556563013", "340143278927825752622671304543834399249", "291353420537940705837069536945415929219", "24490693036086769464968348266781904106", "54179829846868237458114563853365933545", "260421409558767301373816841456228613315", "276080082049035977080617056570628830979"], "threshold":0.9}, "id":"ASB-A-514738229-185a62df", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/f4f0ab21d45103fc84af4486238418fb95be0544", "target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java"}}, {"deprecated":false, "digest":{"function_hash":"37922062061207659278892598815976012623", "length":449}, "id":"ASB-A-514738229-544debcf", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/f4f0ab21d45103fc84af4486238418fb95be0544", "target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java", "function":"notifyPictureProfileHandleSelection"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-11-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/78aaddbc99cad2016d141e8ac75c678d9e33a1f5"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"261755331053639540147144342022228776322", "length":180}, "id":"ASB-A-514738229-bad9c82b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/78aaddbc99cad2016d141e8ac75c678d9e33a1f5", "target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java", "function":"notifyPictureProfileHandleSelection"}}, {"deprecated":false, "digest":{"line_hashes":["302392116496546500293359004136785670835", "167635176702487853859376309051253888773", "186653851592961696770063369086974228242", "302385854177627037885299201132527223475", "337425730470926928819337159829646980126", "276080082049035977080617056570628830979"], "threshold":0.9}, "id":"ASB-A-514738229-dd9b2c0e", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/78aaddbc99cad2016d141e8ac75c678d9e33a1f5", "target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-11-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/b2b33186ce41099571cb7c2b58e311ff5a288341"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"37922062061207659278892598815976012623", "length":449}, "id":"ASB-A-514738229-187d631d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/b2b33186ce41099571cb7c2b58e311ff5a288341", "target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java", "function":"notifyPictureProfileHandleSelection"}}, {"deprecated":false, "digest":{"line_hashes":["324357658243432102337756445572544309746", "152448830456879685040101109300635562693", "238301552452070931647990386623762264068", "149217687815167875097572085584169471977", "196458918112961924860740311398615060283", "122579940017490563447006472107366121299", "60059473715830813855892024481556283171", "181893847494795107251497306910556563013", "340143278927825752622671304543834399249", "291353420537940705837069536945415929219", "24490693036086769464968348266781904106", "54179829846868237458114563853365933545", "260421409558767301373816841456228613315", "276080082049035977080617056570628830979"], "threshold":0.9}, "id":"ASB-A-514738229-5c53a5d8", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/b2b33186ce41099571cb7c2b58e311ff5a288341", "target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-11-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/94775038e3b1d235b65a7c00bb72d94fc20daa64"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"37922062061207659278892598815976012623", "length":449}, "id":"ASB-A-514738229-81db880d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/94775038e3b1d235b65a7c00bb72d94fc20daa64", "target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java", "function":"notifyPictureProfileHandleSelection"}}, {"deprecated":false, "digest":{"line_hashes":["324357658243432102337756445572544309746", "152448830456879685040101109300635562693", "238301552452070931647990386623762264068", "149217687815167875097572085584169471977", "196458918112961924860740311398615060283", "122579940017490563447006472107366121299", "60059473715830813855892024481556283171", "181893847494795107251497306910556563013", "340143278927825752622671304543834399249", "291353420537940705837069536945415929219", "24490693036086769464968348266781904106", "54179829846868237458114563853365933545", "260421409558767301373816841456228613315", "276080082049035977080617056570628830979"], "threshold":0.9}, "id":"ASB-A-514738229-82caca90", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/94775038e3b1d235b65a7c00bb72d94fc20daa64", "target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}