{"id":"ASB-A-514738573", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-02T16:38:00.081625681Z", "aliases":["CVE-2026-58969", "A-514738573"], "details":"In multiple functions of MediaQualityService.java, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/a3b80f7ce7a3c0705ce23ef0a78da55ad8bc75e8"], "severity":"High", "spl":"2026-11-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"75968111871350797374716117111218099496", "length":414}, "id":"ASB-A-514738573-1819fb96", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a3b80f7ce7a3c0705ce23ef0a78da55ad8bc75e8", "target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java", "function":"getSoundProfileHandle"}}, {"deprecated":false, "digest":{"function_hash":"44731740757539782425255364890924601592", "length":393}, "id":"ASB-A-514738573-21976c8c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a3b80f7ce7a3c0705ce23ef0a78da55ad8bc75e8", "target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java", "function":"changeStreamStatus"}}, {"deprecated":false, "digest":{"function_hash":"136695167180809707680414990734137890726", "length":425}, "id":"ASB-A-514738573-2f798423", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a3b80f7ce7a3c0705ce23ef0a78da55ad8bc75e8", "target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java", "function":"getSoundProfileHandles"}}, {"deprecated":false, "digest":{"function_hash":"127210912652326037058959950996971216895", "length":324}, "id":"ASB-A-514738573-b7d837a4", "match_only_versions":["17-qpr2-next"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a3b80f7ce7a3c0705ce23ef0a78da55ad8bc75e8", "target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java", "function":"getPictureProfileHandles"}}, {"deprecated":false, "digest":{"function_hash":"316689722955556252890316772557286074536", "length":673}, "id":"ASB-A-514738573-bbb41b01", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a3b80f7ce7a3c0705ce23ef0a78da55ad8bc75e8", "target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java", "function":"getCurrentPictureProfileForTvInput"}}, {"deprecated":false, "digest":{"line_hashes":["63935159647491669776230661416050959825", "5878535113246630305281161218049081822", "21425213185398705961190530962029078501", "34469644831765651521079379138660887103", "284314181773111065847840835898098043849", "249462752842489073780578338238790828024", "30413569907577416364077373046660802291", "338256918416844609031725071551827170186", "265567590743227180389380985871846166535", "60883053853459115247759513156203237519", "16246521312307932878942424096531657306", "20168779053797833778431958605093379659", "131316974097212363915449424048239112030", "62201951904462080585796953879468546277", "310621453790425017512432711202820360511", "270933647974050237240111042913043093674", "93208182594457378131224371222949398590", "137763330799131906466724952264048137761", "164653503605269560695990518836817907653", "270933647974050237240111042913043093674", "119303218944700277638726319857663987837", "213321798444587238424359389302403865282", "15608955200517133088604937741333764155", "187005337770961473672258370848779357328", "198299295782471091565525168679217228636", "64988218193163757768306990437425992526", "261558917276930009700073559986729430641", "324593661457766231370501030839807546128", "7698378015680125423484765419355849974", "14278630882923785029304331787646562435", "106277359409810563078782569168658195624", "324593661457766231370501030839807546128"], "threshold":0.9}, "id":"ASB-A-514738573-d515a2bd", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a3b80f7ce7a3c0705ce23ef0a78da55ad8bc75e8", "target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java"}}, {"deprecated":false, "digest":{"function_hash":"186890170542716355642869497804687089639", "length":1807}, "id":"ASB-A-514738573-dcb49fde", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a3b80f7ce7a3c0705ce23ef0a78da55ad8bc75e8", "target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java", "function":"getCurrentPictureProfileHandleForTvInput"}}, {"deprecated":false, "digest":{"function_hash":"7951483112429740001219292215476769158", "length":1755}, "id":"ASB-A-514738573-eb92b412", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a3b80f7ce7a3c0705ce23ef0a78da55ad8bc75e8", "target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java", "function":"getPictureProfileForTvInput"}}, {"deprecated":false, "digest":{"function_hash":"127210912652326037058959950996971216895", "length":324}, "id":"ASB-A-514738573-f24ae720", "match_only_versions":["17-qpr2-next"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a3b80f7ce7a3c0705ce23ef0a78da55ad8bc75e8", "target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java", "function":"getPictureProfileHandle"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-11-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/7ea2fce0280537a4b106152b826b7a5d9aac6fbb"], "severity":"High", "spl":"2026-11-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"127210912652326037058959950996971216895", "length":324}, "id":"ASB-A-514738573-0969143c", "match_only_versions":["16-qpr2"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7ea2fce0280537a4b106152b826b7a5d9aac6fbb", "target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java", "function":"getPictureProfileHandle"}}, {"deprecated":false, "digest":{"function_hash":"44731740757539782425255364890924601592", "length":393}, "id":"ASB-A-514738573-0a4b153b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7ea2fce0280537a4b106152b826b7a5d9aac6fbb", "target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java", "function":"changeStreamStatus"}}, {"deprecated":false, "digest":{"function_hash":"36805075702919605960977202180401542857", "length":1444}, "id":"ASB-A-514738573-643b6d58", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7ea2fce0280537a4b106152b826b7a5d9aac6fbb", "target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java", "function":"getPictureProfileForTvInput"}}, {"deprecated":false, "digest":{"function_hash":"51523341188395055412367712679519781531", "length":300}, "id":"ASB-A-514738573-b541157b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7ea2fce0280537a4b106152b826b7a5d9aac6fbb", "target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java", "function":"getCurrentPictureProfileForTvInput"}}, {"deprecated":false, "digest":{"line_hashes":["63935159647491669776230661416050959825", "5878535113246630305281161218049081822", "21425213185398705961190530962029078501", "34469644831765651521079379138660887103", "284314181773111065847840835898098043849", "249462752842489073780578338238790828024", "30413569907577416364077373046660802291", "338256918416844609031725071551827170186", "131316974097212363915449424048239112030", "62201951904462080585796953879468546277", "310621453790425017512432711202820360511", "270933647974050237240111042913043093674", "119303218944700277638726319857663987837", "213321798444587238424359389302403865282", "15608955200517133088604937741333764155", "187005337770961473672258370848779357328", "198299295782471091565525168679217228636", "64988218193163757768306990437425992526", "261558917276930009700073559986729430641", "324593661457766231370501030839807546128"], "threshold":0.9}, "id":"ASB-A-514738573-df24a3a3", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7ea2fce0280537a4b106152b826b7a5d9aac6fbb", "target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java"}}, {"deprecated":false, "digest":{"function_hash":"75968111871350797374716117111218099496", "length":414}, "id":"ASB-A-514738573-e44c914d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7ea2fce0280537a4b106152b826b7a5d9aac6fbb", "target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java", "function":"getSoundProfileHandle"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-11-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/1c17b529207936a1b41d5cece5772cd2f4db0245"], "severity":"High", "spl":"2026-11-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["63935159647491669776230661416050959825", "5878535113246630305281161218049081822", "21425213185398705961190530962029078501", "34469644831765651521079379138660887103", "284314181773111065847840835898098043849", "249462752842489073780578338238790828024", "30413569907577416364077373046660802291", "338256918416844609031725071551827170186", "265567590743227180389380985871846166535", "60883053853459115247759513156203237519", "16246521312307932878942424096531657306", "20168779053797833778431958605093379659", "131316974097212363915449424048239112030", "62201951904462080585796953879468546277", "310621453790425017512432711202820360511", "270933647974050237240111042913043093674", "93208182594457378131224371222949398590", "137763330799131906466724952264048137761", "164653503605269560695990518836817907653", "270933647974050237240111042913043093674", "119303218944700277638726319857663987837", "213321798444587238424359389302403865282", "15608955200517133088604937741333764155", "187005337770961473672258370848779357328", "198299295782471091565525168679217228636", "64988218193163757768306990437425992526", "261558917276930009700073559986729430641", "324593661457766231370501030839807546128", "7698378015680125423484765419355849974", "14278630882923785029304331787646562435", "106277359409810563078782569168658195624", "324593661457766231370501030839807546128"], "threshold":0.9}, "id":"ASB-A-514738573-40fdae44", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1c17b529207936a1b41d5cece5772cd2f4db0245", "target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java"}}, {"deprecated":false, "digest":{"function_hash":"259824757067735663336560075825205012266", "length":1639}, "id":"ASB-A-514738573-61c2f5e2", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1c17b529207936a1b41d5cece5772cd2f4db0245", "target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java", "function":"getPictureProfileForTvInput"}}, {"deprecated":false, "digest":{"function_hash":"75968111871350797374716117111218099496", "length":414}, "id":"ASB-A-514738573-71a46ed7", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1c17b529207936a1b41d5cece5772cd2f4db0245", "target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java", "function":"getSoundProfileHandle"}}, {"deprecated":false, "digest":{"function_hash":"136695167180809707680414990734137890726", "length":425}, "id":"ASB-A-514738573-812bb07f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1c17b529207936a1b41d5cece5772cd2f4db0245", "target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java", "function":"getSoundProfileHandles"}}, {"deprecated":false, "digest":{"function_hash":"44731740757539782425255364890924601592", "length":393}, "id":"ASB-A-514738573-96fa4c61", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1c17b529207936a1b41d5cece5772cd2f4db0245", "target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java", "function":"changeStreamStatus"}}, {"deprecated":false, "digest":{"function_hash":"127210912652326037058959950996971216895", "length":324}, "id":"ASB-A-514738573-9d7b84ec", "match_only_versions":["17"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1c17b529207936a1b41d5cece5772cd2f4db0245", "target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java", "function":"getPictureProfileHandles"}}, {"deprecated":false, "digest":{"function_hash":"127210912652326037058959950996971216895", "length":324}, "id":"ASB-A-514738573-b1f41d68", "match_only_versions":["17"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1c17b529207936a1b41d5cece5772cd2f4db0245", "target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java", "function":"getPictureProfileHandle"}}, {"deprecated":false, "digest":{"function_hash":"180099949139155384184675044415969821664", "length":1676}, "id":"ASB-A-514738573-c00e953d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1c17b529207936a1b41d5cece5772cd2f4db0245", "target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java", "function":"getCurrentPictureProfileHandleForTvInput"}}, {"deprecated":false, "digest":{"function_hash":"51523341188395055412367712679519781531", "length":300}, "id":"ASB-A-514738573-e7fe71a9", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1c17b529207936a1b41d5cece5772cd2f4db0245", "target":{"file":"services/core/java/com/android/server/media/quality/MediaQualityService.java", "function":"getCurrentPictureProfileForTvInput"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}