{"id":"ASB-A-514861024", "published":"2026-10-01T00:00:00Z", "modified":"2026-10-06T15:36:24.859151902Z", "aliases":["CVE-2026-49937", "A-514861024"], "details":"In multiple functions of MessageQueueBase.h, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/system/libfmq", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-10-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/libfmq/+/c4412ddafd204b5acbf2fbbdafe3ce694bc0a364"], "severity":"High", "spl":"2026-10-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["76206041526892211962646396845472950021", "191907528547176398878570017263759147866", "32531547688005130789249358872211243324", "118169809678537940249736560515862445813", "68822940984096068597527581011535437451", "9555991473144796255311608425495533017", "60049057751997589590320245186725948066", "251556598417090489985932279558640173387", "120984670660931273951859659480743918781", "61388105964995959819153637772251961266", "115503196078699863709844467656199545948"], "threshold":0.9}, "id":"ASB-A-514861024-04cdd82c", "match_only_versions":["17-next"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/libfmq/+/c4412ddafd204b5acbf2fbbdafe3ce694bc0a364", "target":{"file":"tests/msgq_test_client.cpp"}}, {"deprecated":false, "digest":{"line_hashes":["45867215650520688777788023400164125596", "140133464956813212667640632040045683136", "270644677685351241147787344024237775428", "305418672955264418933735273582641511343", "25834229121459270055445882568464104031", "69934951959070445512155718714614681533", "224678711229732403720595416488040702023", "235032928215245813665202753175510967638", "62982596592540177813972081673949407608", "245763996035722372298532106121204853576", "116849330672720531274231227524568962138", "101929453765516955171117321362850686385", "74390736163807888829628728104799016777", "118801887538252480555983151005960889197", "228260174008800986097582454956428034809", "152546019295191193675496017617108237698", "92357591836820672827276442257004540190", "132563578786840273871339470800988818048", "211388129820078743066876071758245879606"], "threshold":0.9}, "id":"ASB-A-514861024-0bd47236", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/libfmq/+/c4412ddafd204b5acbf2fbbdafe3ce694bc0a364", "target":{"file":"include/fmq/MessageQueueBase.h"}}, {"deprecated":false, "digest":{"function_hash":"139911085098309030906339346490630516306", "length":1246}, "id":"ASB-A-514861024-283255ee", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/libfmq/+/c4412ddafd204b5acbf2fbbdafe3ce694bc0a364", "target":{"file":"include/fmq/MessageQueueBase.h", "function":"beginRead"}}, {"deprecated":false, "digest":{"function_hash":"123939678422657434405001169811322595003", "length":1227}, "id":"ASB-A-514861024-2df46c6d", "match_only_versions":["17-next"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/libfmq/+/c4412ddafd204b5acbf2fbbdafe3ce694bc0a364", "target":{"file":"tests/msgq_test_client.cpp", "function":"TYPED_TEST"}}, {"deprecated":false, "digest":{"function_hash":"301300884765238787500469677348231182317", "length":547}, "id":"ASB-A-514861024-cf44903b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/libfmq/+/c4412ddafd204b5acbf2fbbdafe3ce694bc0a364", "target":{"file":"include/fmq/MessageQueueBase.h", "function":"availableToReadBytes"}}]}}, {"package":{"name":"platform/system/libfmq", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-10-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/libfmq/+/1c74c042be1ef04a80c6387e0ffd1069cb9fcfad"], "severity":"High", "spl":"2026-10-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"69729402645744846437019567190237861174", "length":1088}, "id":"ASB-A-514861024-8e1e9e97", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/libfmq/+/1c74c042be1ef04a80c6387e0ffd1069cb9fcfad", "target":{"file":"include/fmq/MessageQueueBase.h", "function":"beginRead"}}, {"deprecated":false, "digest":{"line_hashes":["45815788745352691128219145941103992219", "140133464956813212667640632040045683136", "270644677685351241147787344024237775428", "305418672955264418933735273582641511343", "25834229121459270055445882568464104031", "69934951959070445512155718714614681533", "85216015122803612932386534835877634417", "279917927168249908132223467729599692894", "101929453765516955171117321362850686385", "74390736163807888829628728104799016777", "118801887538252480555983151005960889197", "228260174008800986097582454956428034809", "152546019295191193675496017617108237698", "92357591836820672827276442257004540190", "132563578786840273871339470800988818048", "211388129820078743066876071758245879606"], "threshold":0.9}, "id":"ASB-A-514861024-a7b86824", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/libfmq/+/1c74c042be1ef04a80c6387e0ffd1069cb9fcfad", "target":{"file":"include/fmq/MessageQueueBase.h"}}, {"deprecated":false, "digest":{"function_hash":"131637233386850605503462537491971777005", "length":620}, "id":"ASB-A-514861024-c008ef99", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/libfmq/+/1c74c042be1ef04a80c6387e0ffd1069cb9fcfad", "target":{"file":"include/fmq/MessageQueueBase.h", "function":"availableToReadBytes"}}]}}, {"package":{"name":"platform/system/libfmq", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-10-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/libfmq/+/0a35fb4c564387082635018cb6c9aca2659ead94"], "severity":"High", "spl":"2026-10-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"287949070367596628806325081634248255873", "length":1020}, "id":"ASB-A-514861024-6a38a600", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/libfmq/+/0a35fb4c564387082635018cb6c9aca2659ead94", "target":{"file":"include/fmq/MessageQueueBase.h", "function":"beginRead"}}, {"deprecated":false, "digest":{"function_hash":"301300884765238787500469677348231182317", "length":547}, "id":"ASB-A-514861024-76b10134", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/libfmq/+/0a35fb4c564387082635018cb6c9aca2659ead94", "target":{"file":"include/fmq/MessageQueueBase.h", "function":"availableToReadBytes"}}, {"deprecated":false, "digest":{"line_hashes":["45867215650520688777788023400164125596", "140133464956813212667640632040045683136", "270644677685351241147787344024237775428", "305418672955264418933735273582641511343", "25834229121459270055445882568464104031", "69934951959070445512155718714614681533", "224678711229732403720595416488040702023", "235032928215245813665202753175510967638", "62982596592540177813972081673949407608", "245763996035722372298532106121204853576", "116849330672720531274231227524568962138", "101929453765516955171117321362850686385", "74390736163807888829628728104799016777", "118801887538252480555983151005960889197", "228260174008800986097582454956428034809", "152546019295191193675496017617108237698", "92357591836820672827276442257004540190", "132563578786840273871339470800988818048", "211388129820078743066876071758245879606"], "threshold":0.9}, "id":"ASB-A-514861024-e38cd32d", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/libfmq/+/0a35fb4c564387082635018cb6c9aca2659ead94", "target":{"file":"include/fmq/MessageQueueBase.h"}}]}}, {"package":{"name":"platform/system/libfmq", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-10-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/libfmq/+/1e57a1c7890543dba24d8a4476225979e0568ab1"], "severity":"High", "spl":"2026-10-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["45867215650520688777788023400164125596", "140133464956813212667640632040045683136", "270644677685351241147787344024237775428", "305418672955264418933735273582641511343", "25834229121459270055445882568464104031", "69934951959070445512155718714614681533", "224678711229732403720595416488040702023", "235032928215245813665202753175510967638", "62982596592540177813972081673949407608", "245763996035722372298532106121204853576", "116849330672720531274231227524568962138", "101929453765516955171117321362850686385", "74390736163807888829628728104799016777", "118801887538252480555983151005960889197", "228260174008800986097582454956428034809", "152546019295191193675496017617108237698", "92357591836820672827276442257004540190", "132563578786840273871339470800988818048", "211388129820078743066876071758245879606"], "threshold":0.9}, "id":"ASB-A-514861024-3e4027a6", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/libfmq/+/1e57a1c7890543dba24d8a4476225979e0568ab1", "target":{"file":"include/fmq/MessageQueueBase.h"}}, {"deprecated":false, "digest":{"function_hash":"12952492091312389243018081015368007061", "length":1143}, "id":"ASB-A-514861024-43fb9cc0", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/libfmq/+/1e57a1c7890543dba24d8a4476225979e0568ab1", "target":{"file":"include/fmq/MessageQueueBase.h", "function":"beginRead"}}, {"deprecated":false, "digest":{"function_hash":"301300884765238787500469677348231182317", "length":547}, "id":"ASB-A-514861024-6c022b06", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/libfmq/+/1e57a1c7890543dba24d8a4476225979e0568ab1", "target":{"file":"include/fmq/MessageQueueBase.h", "function":"availableToReadBytes"}}]}}, {"package":{"name":"platform/system/libfmq", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-10-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/libfmq/+/92cf2be8cb402c8c324eed46d20bddc4bee6bb58"], "severity":"High", "spl":"2026-10-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["45867215650520688777788023400164125596", "140133464956813212667640632040045683136", "270644677685351241147787344024237775428", "305418672955264418933735273582641511343", "25834229121459270055445882568464104031", "69934951959070445512155718714614681533", "224678711229732403720595416488040702023", "235032928215245813665202753175510967638", "62982596592540177813972081673949407608", "245763996035722372298532106121204853576", "116849330672720531274231227524568962138", "101929453765516955171117321362850686385", "74390736163807888829628728104799016777", "118801887538252480555983151005960889197", "228260174008800986097582454956428034809", "152546019295191193675496017617108237698", "92357591836820672827276442257004540190", "132563578786840273871339470800988818048", "211388129820078743066876071758245879606"], "threshold":0.9}, "id":"ASB-A-514861024-21058cae", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/libfmq/+/92cf2be8cb402c8c324eed46d20bddc4bee6bb58", "target":{"file":"include/fmq/MessageQueueBase.h"}}, {"deprecated":false, "digest":{"function_hash":"301300884765238787500469677348231182317", "length":547}, "id":"ASB-A-514861024-65ce5229", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/libfmq/+/92cf2be8cb402c8c324eed46d20bddc4bee6bb58", "target":{"file":"include/fmq/MessageQueueBase.h", "function":"availableToReadBytes"}}, {"deprecated":false, "digest":{"function_hash":"139911085098309030906339346490630516306", "length":1246}, "id":"ASB-A-514861024-99fec029", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/libfmq/+/92cf2be8cb402c8c324eed46d20bddc4bee6bb58", "target":{"file":"include/fmq/MessageQueueBase.h", "function":"beginRead"}}]}}, {"package":{"name":"platform/system/libfmq", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-10-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/system/libfmq/+/7e9c2e78af85bfe39bd33bf5f95dd65a62be3392"], "severity":"High", "spl":"2026-10-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"76824368080490118361616513206811986012", "length":1088}, "id":"ASB-A-514861024-0cf1d729", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/libfmq/+/7e9c2e78af85bfe39bd33bf5f95dd65a62be3392", "target":{"file":"include/fmq/MessageQueueBase.h", "function":"beginRead"}}, {"deprecated":false, "digest":{"line_hashes":["236790446554061048025514260668192785994", "145374696072744784137128413298272023714", "157559149598288620879374759851558678482", "247644322104168295171153532836549454340", "31762282903101419616984183156013777100", "315050152128380115997968616444699884437", "336358305495026340785883668739171057697", "74390736163807888829628728104799016777", "118801887538252480555983151005960889197", "228260174008800986097582454956428034809", "152546019295191193675496017617108237698", "92357591836820672827276442257004540190", "132563578786840273871339470800988818048", "211388129820078743066876071758245879606"], "threshold":0.9}, "id":"ASB-A-514861024-36475657", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/libfmq/+/7e9c2e78af85bfe39bd33bf5f95dd65a62be3392", "target":{"file":"include/fmq/MessageQueueBase.h"}}, {"deprecated":false, "digest":{"function_hash":"95745458625735590135592403573869272846", "length":353}, "id":"ASB-A-514861024-ca0af4e1", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/system/libfmq/+/7e9c2e78af85bfe39bd33bf5f95dd65a62be3392", "target":{"file":"include/fmq/MessageQueueBase.h", "function":"availableToReadBytes"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-10-01"}]}