{"id":"ASB-A-514745329", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-05T16:32:28.703711716Z", "aliases":["CVE-2026-58985", "A-514745329"], "details":"In handleConnectInternal of RpcServerTrusty.cpp, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/native", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/native/+/8017334ca67f87d35fab8c64575c5d1a3843cb0e"], "severity":"High", "spl":"2026-11-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["325418093315597050185588787419573451861", "118447729434934649182416740092151683507", "169964899884083517509248243314945108012", "34601429263827609268043056956872869968"], "threshold":0.9}, "id":"ASB-A-514745329-0b68407d", "match_only_versions":["17-qpr2-next"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/8017334ca67f87d35fab8c64575c5d1a3843cb0e", "target":{"file":"libs/binder/include/binder/RpcServer.h"}}, {"deprecated":false, "digest":{"line_hashes":["160318620370089547091656989526883584705", "306656578026064346377162498907125058868", "106196993027315081445079653102663905710", "86000905799217755811177415477396899841", "182306463363826359128165538115316301489", "76716931128753752918798910906837440701", "194812490474783064897682372090879126911", "244927105927849299050944312433887299755", "47164754407184939608932029596815149538", "188172418735280445927210632917029788790", "321515081199778036677502771163397226526", "147023106998877109480784037798836405295", "6143125810994274763452516627996748791", "37221337840827132447572957251773506466", "339090333155018648056937345735583373036", "779303450846542017689501238367910492", "221915178294030951044176646062167776177"], "threshold":0.9}, "id":"ASB-A-514745329-2f08e702", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/8017334ca67f87d35fab8c64575c5d1a3843cb0e", "target":{"file":"libs/binder/RpcSession.cpp"}}, {"deprecated":false, "digest":{"function_hash":"220745399327824557108566903971502042354", "length":339}, "id":"ASB-A-514745329-b122674c", "match_only_versions":["17-qpr2-next"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/8017334ca67f87d35fab8c64575c5d1a3843cb0e", "target":{"file":"libs/binder/trusty/RpcServerTrusty.cpp", "function":"RpcServerTrusty::handleChannelCleanup"}}, {"deprecated":false, "digest":{"function_hash":"80235010618170023483659123137963103657", "length":483}, "id":"ASB-A-514745329-b9d6f82d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/8017334ca67f87d35fab8c64575c5d1a3843cb0e", "target":{"file":"libs/binder/RpcSession.cpp", "function":"RpcSession::addOutgoingConnection"}}, {"deprecated":false, "digest":{"line_hashes":["2602690693896598654820071353821342646", "209112979277181566066986095850770088311", "138534607363678736182739674695324908365", "131362512551207320535991380209170127225", "147055476377445878196008379878449294406", "251200354608618665343628869520055067564", "20203843541672812377649370731096539720", "120791622384888411547853703172736977382", "285410202692874450087033027365517268495", "300184506551392104708180648646232259408", "91289743724652560067485787071421072247", "27772190699729289577855237266228479995", "11572721583465300624083130603941948072", "309051846484325168996222234517770821016", "169606483864205200399829645654411268248", "237443678143905019231378640542252157129", "94027533458072500677356976310910219192", "94027533458072500677356976310910219192", "18875876403435054284961036060737452833", "225524233870238000925242267501778675118", "183783837437157205326293055416546964181", "172632642273919690393835312515705560716", "28329220550957932451198063825544452770", "290474914431411914585798291205226767825"], "threshold":0.9}, "id":"ASB-A-514745329-bb72e999", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/8017334ca67f87d35fab8c64575c5d1a3843cb0e", "target":{"file":"libs/binder/trusty/RpcServerTrusty.cpp"}}, {"deprecated":false, "digest":{"line_hashes":["328677694410026104946086264787837698233", "197084226930080022592850955142418015921", "300139929290678269592681639647826318121", "139343356563536984703072284957584095592", "158316759580794338381005120304700823891", "64152673993155104300952454713619982428", "119536901366158043530241054481674326427", "186377705989754539474204065217504275744", "80857662015494870962479131594026273336", "272406148882359970529560952102353951257", "257674835596158548266358828557369974403", "37382654941522340354261436110645554843", "88226416339857126985995427885394904980"], "threshold":0.9}, "id":"ASB-A-514745329-bdaa8206", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/8017334ca67f87d35fab8c64575c5d1a3843cb0e", "target":{"file":"libs/binder/RpcServer.cpp"}}, {"deprecated":false, "digest":{"line_hashes":["273878674210437934417602070602330267813", "61716428665960132741569256855223898298", "326475060789664204422586401871302328739", "9543864053580854589147504315459479886"], "threshold":0.9}, "id":"ASB-A-514745329-d23948f4", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/8017334ca67f87d35fab8c64575c5d1a3843cb0e", "target":{"file":"libs/binder/trusty/include/binder/RpcServerTrusty.h"}}, {"deprecated":false, "digest":{"line_hashes":["53734488833367912354109056267001367449", "19474075900629343993967111447790127432", "54685299793862979708674155656203434502", "84060781445117946564564625550515397576", "182766586154881216192105087611521277528", "216773350757917889801756615803524114431", "271233895209511156991196788744388949170", "299025927355930700626025452241239945812", "28622143111185373257613477859799102876", "25761713523948121672857945783485935031", "136573464687212419425894884588221941064"], "threshold":0.9}, "id":"ASB-A-514745329-dd851734", "match_only_versions":["17-qpr2-next"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/8017334ca67f87d35fab8c64575c5d1a3843cb0e", "target":{"file":"libs/binder/include/binder/RpcSession.h"}}, {"deprecated":false, "digest":{"function_hash":"310963165716737363396101621461446552197", "length":1173}, "id":"ASB-A-514745329-e5d29d6c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/8017334ca67f87d35fab8c64575c5d1a3843cb0e", "target":{"file":"libs/binder/trusty/RpcServerTrusty.cpp", "function":"RpcServerTrusty::handleConnectInternal"}}]}}, {"package":{"name":"platform/frameworks/native", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-11-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/native/+/4c4fb2c40ecf0dea7291a65bb8ef3e204df49d48"], "severity":"High", "spl":"2026-11-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["2602690693896598654820071353821342646", "209112979277181566066986095850770088311", "138534607363678736182739674695324908365", "131362512551207320535991380209170127225", "147055476377445878196008379878449294406", "251200354608618665343628869520055067564", "20203843541672812377649370731096539720", "120791622384888411547853703172736977382", "285410202692874450087033027365517268495", "300184506551392104708180648646232259408", "91289743724652560067485787071421072247", "27772190699729289577855237266228479995", "11572721583465300624083130603941948072", "309051846484325168996222234517770821016", "169606483864205200399829645654411268248", "237443678143905019231378640542252157129", "94027533458072500677356976310910219192", "94027533458072500677356976310910219192", "18875876403435054284961036060737452833", "225524233870238000925242267501778675118", "183783837437157205326293055416546964181", "172632642273919690393835312515705560716", "28329220550957932451198063825544452770", "290474914431411914585798291205226767825"], "threshold":0.9}, "id":"ASB-A-514745329-042d51d9", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/4c4fb2c40ecf0dea7291a65bb8ef3e204df49d48", "target":{"file":"libs/binder/trusty/RpcServerTrusty.cpp"}}, {"deprecated":false, "digest":{"function_hash":"310963165716737363396101621461446552197", "length":1173}, "id":"ASB-A-514745329-1a1328c9", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/4c4fb2c40ecf0dea7291a65bb8ef3e204df49d48", "target":{"file":"libs/binder/trusty/RpcServerTrusty.cpp", "function":"RpcServerTrusty::handleConnectInternal"}}, {"deprecated":false, "digest":{"line_hashes":["160318620370089547091656989526883584705", "306656578026064346377162498907125058868", "106196993027315081445079653102663905710", "86000905799217755811177415477396899841", "182306463363826359128165538115316301489", "76716931128753752918798910906837440701", "194812490474783064897682372090879126911", "244927105927849299050944312433887299755", "47164754407184939608932029596815149538", "188172418735280445927210632917029788790", "294003716432292918104080438101113678599", "30796829010423977547645512996481285023", "176239844454768304825829774334789385709", "275723464973640835139513951805523197702", "302961846046410246192412890536546644792", "339090333155018648056937345735583373036", "779303450846542017689501238367910492", "221915178294030951044176646062167776177"], "threshold":0.9}, "id":"ASB-A-514745329-32a19949", "match_only_versions":["16-qpr2"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/4c4fb2c40ecf0dea7291a65bb8ef3e204df49d48", "target":{"file":"libs/binder/RpcSession.cpp"}}, {"deprecated":false, "digest":{"function_hash":"156777688215780974847367472905022958762", "length":517}, "id":"ASB-A-514745329-993ea6f9", "match_only_versions":["16-qpr2"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/4c4fb2c40ecf0dea7291a65bb8ef3e204df49d48", "target":{"file":"libs/binder/RpcSession.cpp", "function":"RpcSession::addOutgoingConnection"}}, {"deprecated":false, "digest":{"line_hashes":["273878674210437934417602070602330267813", "61716428665960132741569256855223898298", "326475060789664204422586401871302328739", "9543864053580854589147504315459479886"], "threshold":0.9}, "id":"ASB-A-514745329-a04d20e1", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/4c4fb2c40ecf0dea7291a65bb8ef3e204df49d48", "target":{"file":"libs/binder/trusty/include/binder/RpcServerTrusty.h"}}, {"deprecated":false, "digest":{"line_hashes":["53734488833367912354109056267001367449", "19474075900629343993967111447790127432", "54685299793862979708674155656203434502", "84060781445117946564564625550515397576", "182766586154881216192105087611521277528", "216773350757917889801756615803524114431", "271233895209511156991196788744388949170", "299025927355930700626025452241239945812", "28622143111185373257613477859799102876", "25761713523948121672857945783485935031", "136573464687212419425894884588221941064"], "threshold":0.9}, "id":"ASB-A-514745329-ca59a27f", "match_only_versions":["16-qpr2"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/4c4fb2c40ecf0dea7291a65bb8ef3e204df49d48", "target":{"file":"libs/binder/include/binder/RpcSession.h"}}, {"deprecated":false, "digest":{"function_hash":"220745399327824557108566903971502042354", "length":339}, "id":"ASB-A-514745329-d3e51d99", "match_only_versions":["16-qpr2"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/4c4fb2c40ecf0dea7291a65bb8ef3e204df49d48", "target":{"file":"libs/binder/trusty/RpcServerTrusty.cpp", "function":"RpcServerTrusty::handleChannelCleanup"}}, {"deprecated":false, "digest":{"line_hashes":["328677694410026104946086264787837698233", "197084226930080022592850955142418015921", "300139929290678269592681639647826318121", "139343356563536984703072284957584095592", "158316759580794338381005120304700823891", "64152673993155104300952454713619982428", "119536901366158043530241054481674326427", "186377705989754539474204065217504275744", "80857662015494870962479131594026273336", "272406148882359970529560952102353951257", "257674835596158548266358828557369974403", "37382654941522340354261436110645554843", "88226416339857126985995427885394904980"], "threshold":0.9}, "id":"ASB-A-514745329-e472536f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/4c4fb2c40ecf0dea7291a65bb8ef3e204df49d48", "target":{"file":"libs/binder/RpcServer.cpp"}}, {"deprecated":false, "digest":{"line_hashes":["325418093315597050185588787419573451861", "118447729434934649182416740092151683507", "169964899884083517509248243314945108012", "34601429263827609268043056956872869968"], "threshold":0.9}, "id":"ASB-A-514745329-f3fb8af5", "match_only_versions":["16-qpr2"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/4c4fb2c40ecf0dea7291a65bb8ef3e204df49d48", "target":{"file":"libs/binder/include/binder/RpcServer.h"}}]}}, {"package":{"name":"platform/frameworks/native", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-11-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/native/+/7b08f25146ad08922b476f76d49478592f0070a1"], "severity":"High", "spl":"2026-11-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["53734488833367912354109056267001367449", "19474075900629343993967111447790127432", "54685299793862979708674155656203434502", "84060781445117946564564625550515397576", "182766586154881216192105087611521277528", "216773350757917889801756615803524114431", "271233895209511156991196788744388949170", "299025927355930700626025452241239945812", "28622143111185373257613477859799102876", "25761713523948121672857945783485935031", "136573464687212419425894884588221941064"], "threshold":0.9}, "id":"ASB-A-514745329-1fb13910", "match_only_versions":["17"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/7b08f25146ad08922b476f76d49478592f0070a1", "target":{"file":"libs/binder/include/binder/RpcSession.h"}}, {"deprecated":false, "digest":{"function_hash":"80235010618170023483659123137963103657", "length":483}, "id":"ASB-A-514745329-2059a482", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/7b08f25146ad08922b476f76d49478592f0070a1", "target":{"file":"libs/binder/RpcSession.cpp", "function":"RpcSession::addOutgoingConnection"}}, {"deprecated":false, "digest":{"line_hashes":["273878674210437934417602070602330267813", "61716428665960132741569256855223898298", "326475060789664204422586401871302328739", "9543864053580854589147504315459479886"], "threshold":0.9}, "id":"ASB-A-514745329-29f93692", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/7b08f25146ad08922b476f76d49478592f0070a1", "target":{"file":"libs/binder/trusty/include/binder/RpcServerTrusty.h"}}, {"deprecated":false, "digest":{"line_hashes":["160318620370089547091656989526883584705", "306656578026064346377162498907125058868", "106196993027315081445079653102663905710", "86000905799217755811177415477396899841", "182306463363826359128165538115316301489", "76716931128753752918798910906837440701", "194812490474783064897682372090879126911", "244927105927849299050944312433887299755", "47164754407184939608932029596815149538", "188172418735280445927210632917029788790", "321515081199778036677502771163397226526", "147023106998877109480784037798836405295", "6143125810994274763452516627996748791", "37221337840827132447572957251773506466", "339090333155018648056937345735583373036", "779303450846542017689501238367910492", "221915178294030951044176646062167776177"], "threshold":0.9}, "id":"ASB-A-514745329-2d88c9c5", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/7b08f25146ad08922b476f76d49478592f0070a1", "target":{"file":"libs/binder/RpcSession.cpp"}}, {"deprecated":false, "digest":{"line_hashes":["328677694410026104946086264787837698233", "197084226930080022592850955142418015921", "300139929290678269592681639647826318121", "139343356563536984703072284957584095592", "158316759580794338381005120304700823891", "64152673993155104300952454713619982428", "119536901366158043530241054481674326427", "186377705989754539474204065217504275744", "80857662015494870962479131594026273336", "272406148882359970529560952102353951257", "257674835596158548266358828557369974403", "37382654941522340354261436110645554843", "88226416339857126985995427885394904980"], "threshold":0.9}, "id":"ASB-A-514745329-5312e6e4", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/7b08f25146ad08922b476f76d49478592f0070a1", "target":{"file":"libs/binder/RpcServer.cpp"}}, {"deprecated":false, "digest":{"line_hashes":["2602690693896598654820071353821342646", "209112979277181566066986095850770088311", "138534607363678736182739674695324908365", "131362512551207320535991380209170127225", "147055476377445878196008379878449294406", "251200354608618665343628869520055067564", "20203843541672812377649370731096539720", "120791622384888411547853703172736977382", "285410202692874450087033027365517268495", "300184506551392104708180648646232259408", "91289743724652560067485787071421072247", "27772190699729289577855237266228479995", "11572721583465300624083130603941948072", "309051846484325168996222234517770821016", "169606483864205200399829645654411268248", "237443678143905019231378640542252157129", "94027533458072500677356976310910219192", "94027533458072500677356976310910219192", "18875876403435054284961036060737452833", "225524233870238000925242267501778675118", "183783837437157205326293055416546964181", "172632642273919690393835312515705560716", "28329220550957932451198063825544452770", "290474914431411914585798291205226767825"], "threshold":0.9}, "id":"ASB-A-514745329-731b6b4d", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/7b08f25146ad08922b476f76d49478592f0070a1", "target":{"file":"libs/binder/trusty/RpcServerTrusty.cpp"}}, {"deprecated":false, "digest":{"function_hash":"310963165716737363396101621461446552197", "length":1173}, "id":"ASB-A-514745329-7565fda8", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/7b08f25146ad08922b476f76d49478592f0070a1", "target":{"file":"libs/binder/trusty/RpcServerTrusty.cpp", "function":"RpcServerTrusty::handleConnectInternal"}}, {"deprecated":false, "digest":{"line_hashes":["325418093315597050185588787419573451861", "118447729434934649182416740092151683507", "169964899884083517509248243314945108012", "34601429263827609268043056956872869968"], "threshold":0.9}, "id":"ASB-A-514745329-dfa5dbd4", "match_only_versions":["17"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/7b08f25146ad08922b476f76d49478592f0070a1", "target":{"file":"libs/binder/include/binder/RpcServer.h"}}, {"deprecated":false, "digest":{"function_hash":"220745399327824557108566903971502042354", "length":339}, "id":"ASB-A-514745329-f85f01fd", "match_only_versions":["17"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/7b08f25146ad08922b476f76d49478592f0070a1", "target":{"file":"libs/binder/trusty/RpcServerTrusty.cpp", "function":"RpcServerTrusty::handleChannelCleanup"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}