{"id":"ASB-A-515038894", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-02T16:38:00.081625681Z", "aliases":["CVE-2026-58875", "A-515038894"], "details":"In multiple locations, there is a possible denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/4439c37ea4d31b1cfdd99d2f7b90efe000019fb5"], "severity":"High", "spl":"2026-11-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"335455891683046016734286597225358668526", "length":1670}, "exact_target_file_match_only":true, "id":"ASB-A-515038894-31054870", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/4439c37ea4d31b1cfdd99d2f7b90efe000019fb5", "target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/BundlePolicySerializer.java", "function":"writeBundle"}}, {"deprecated":false, "digest":{"line_hashes":["162650519800005454501044961921539234740", "204987794194783212035451606112588096894", "158218492816319073545052545840941953302", "253509162939209170374914067461442000582", "37997544194398040395011945097086673139", "7895669008674567970537792357723895015", "175579121158468716987440761551257615414", "146313485012384398407829236266616846378", "60172917206724522744580435407831004335", "30378688722491261743343452195783639086", "135256857446213728468876247704345105472", "128337708091765832135411580191428884993", "186118732364553440545191216726505730065"], "threshold":0.9}, "exact_target_file_match_only":true, "id":"ASB-A-515038894-894d36c2", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/4439c37ea4d31b1cfdd99d2f7b90efe000019fb5", "target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/BundlePolicySerializer.java"}}, {"deprecated":false, "digest":{"line_hashes":["326702412561026300024393815901295686604", "156472992673584159090915524232794286114", "334149357670228648920450111726280653985", "313631074303561151230177818364313802212"], "threshold":0.9}, "id":"ASB-A-515038894-8a16bbeb", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/4439c37ea4d31b1cfdd99d2f7b90efe000019fb5", "target":{"file":"core/java/android/app/admin/BundlePolicyValue.java"}}, {"deprecated":false, "digest":{"function_hash":"151382637282007823010701210116897683337", "length":88}, "id":"ASB-A-515038894-9bb4e780", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/4439c37ea4d31b1cfdd99d2f7b90efe000019fb5", "target":{"file":"core/java/android/app/admin/BundlePolicyValue.java", "function":"BundlePolicyValue"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-11-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/3b224c4cc4936ddbe6a67788876fd5ac3dcbcd58"], "severity":"High", "spl":"2026-11-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["7540256208188569581567591137097669405", "297774780391349797203350345284766764073", "258132645464798362332910337890688245894", "56970640530097525276345500447958491870"], "threshold":0.9}, "id":"ASB-A-515038894-4b7fc81c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/3b224c4cc4936ddbe6a67788876fd5ac3dcbcd58", "target":{"file":"core/java/android/app/admin/BundlePolicyValue.java"}}, {"deprecated":false, "digest":{"function_hash":"335455891683046016734286597225358668526", "length":1670}, "exact_target_file_match_only":true, "id":"ASB-A-515038894-62d06e64", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/3b224c4cc4936ddbe6a67788876fd5ac3dcbcd58", "target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/BundlePolicySerializer.java", "function":"writeBundle"}}, {"deprecated":false, "digest":{"function_hash":"233904148531596839480881800503722808465", "length":120}, "id":"ASB-A-515038894-ac843bf5", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/3b224c4cc4936ddbe6a67788876fd5ac3dcbcd58", "target":{"file":"core/java/android/app/admin/BundlePolicyValue.java", "function":"BundlePolicyValue"}}, {"deprecated":false, "digest":{"line_hashes":["162650519800005454501044961921539234740", "204987794194783212035451606112588096894", "158218492816319073545052545840941953302", "253509162939209170374914067461442000582", "37997544194398040395011945097086673139", "7895669008674567970537792357723895015", "175579121158468716987440761551257615414", "146313485012384398407829236266616846378", "60172917206724522744580435407831004335", "30378688722491261743343452195783639086", "135256857446213728468876247704345105472", "128337708091765832135411580191428884993", "186118732364553440545191216726505730065"], "threshold":0.9}, "exact_target_file_match_only":true, "id":"ASB-A-515038894-f675e21b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/3b224c4cc4936ddbe6a67788876fd5ac3dcbcd58", "target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/BundlePolicySerializer.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-11-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/c46686151da28380cb7eed6938cd6f9467e9afe4"], "severity":"High", "spl":"2026-11-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"335455891683046016734286597225358668526", "length":1670}, "exact_target_file_match_only":true, "id":"ASB-A-515038894-17afed00", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/c46686151da28380cb7eed6938cd6f9467e9afe4", "target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/BundlePolicySerializer.java", "function":"writeBundle"}}, {"deprecated":false, "digest":{"line_hashes":["162650519800005454501044961921539234740", "204987794194783212035451606112588096894", "158218492816319073545052545840941953302", "253509162939209170374914067461442000582", "37997544194398040395011945097086673139", "7895669008674567970537792357723895015", "175579121158468716987440761551257615414", "146313485012384398407829236266616846378", "60172917206724522744580435407831004335", "30378688722491261743343452195783639086", "135256857446213728468876247704345105472", "128337708091765832135411580191428884993", "186118732364553440545191216726505730065"], "threshold":0.9}, "exact_target_file_match_only":true, "id":"ASB-A-515038894-2433f008", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/c46686151da28380cb7eed6938cd6f9467e9afe4", "target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/BundlePolicySerializer.java"}}, {"deprecated":false, "digest":{"line_hashes":["7540256208188569581567591137097669405", "178219666398875587161627291125987802221", "334149357670228648920450111726280653985", "313631074303561151230177818364313802212"], "threshold":0.9}, "id":"ASB-A-515038894-b0273b63", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/c46686151da28380cb7eed6938cd6f9467e9afe4", "target":{"file":"core/java/android/app/admin/BundlePolicyValue.java"}}, {"deprecated":false, "digest":{"function_hash":"151382637282007823010701210116897683337", "length":88}, "id":"ASB-A-515038894-ba531c74", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/c46686151da28380cb7eed6938cd6f9467e9afe4", "target":{"file":"core/java/android/app/admin/BundlePolicyValue.java", "function":"BundlePolicyValue"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-11-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/3809dd9cc37820872f852b0afd07706076d77ed2"], "severity":"High", "spl":"2026-11-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"151382637282007823010701210116897683337", "length":88}, "id":"ASB-A-515038894-0e86482a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/3809dd9cc37820872f852b0afd07706076d77ed2", "target":{"file":"core/java/android/app/admin/BundlePolicyValue.java", "function":"BundlePolicyValue"}}, {"deprecated":false, "digest":{"line_hashes":["162650519800005454501044961921539234740", "204987794194783212035451606112588096894", "158218492816319073545052545840941953302", "253509162939209170374914067461442000582", "37997544194398040395011945097086673139", "7895669008674567970537792357723895015", "175579121158468716987440761551257615414", "146313485012384398407829236266616846378", "60172917206724522744580435407831004335", "30378688722491261743343452195783639086", "135256857446213728468876247704345105472", "128337708091765832135411580191428884993", "186118732364553440545191216726505730065"], "threshold":0.9}, "exact_target_file_match_only":true, "id":"ASB-A-515038894-2bfa0fd9", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/3809dd9cc37820872f852b0afd07706076d77ed2", "target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/BundlePolicySerializer.java"}}, {"deprecated":false, "digest":{"function_hash":"335455891683046016734286597225358668526", "length":1670}, "exact_target_file_match_only":true, "id":"ASB-A-515038894-98ce1a18", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/3809dd9cc37820872f852b0afd07706076d77ed2", "target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/BundlePolicySerializer.java", "function":"writeBundle"}}, {"deprecated":false, "digest":{"line_hashes":["7540256208188569581567591137097669405", "178219666398875587161627291125987802221", "334149357670228648920450111726280653985", "313631074303561151230177818364313802212"], "threshold":0.9}, "id":"ASB-A-515038894-ee7ce868", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/3809dd9cc37820872f852b0afd07706076d77ed2", "target":{"file":"core/java/android/app/admin/BundlePolicyValue.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-11-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/f840119d646c05edb7880c9f1276f92aa1c4736b"], "severity":"High", "spl":"2026-11-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"335455891683046016734286597225358668526", "length":1670}, "exact_target_file_match_only":true, "id":"ASB-A-515038894-84071e26", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/f840119d646c05edb7880c9f1276f92aa1c4736b", "target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/BundlePolicySerializer.java", "function":"writeBundle"}}, {"deprecated":false, "digest":{"function_hash":"151382637282007823010701210116897683337", "length":88}, "id":"ASB-A-515038894-a19ba712", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/f840119d646c05edb7880c9f1276f92aa1c4736b", "target":{"file":"core/java/android/app/admin/BundlePolicyValue.java", "function":"BundlePolicyValue"}}, {"deprecated":false, "digest":{"line_hashes":["162650519800005454501044961921539234740", "204987794194783212035451606112588096894", "158218492816319073545052545840941953302", "253509162939209170374914067461442000582", "37997544194398040395011945097086673139", "7895669008674567970537792357723895015", "175579121158468716987440761551257615414", "146313485012384398407829236266616846378", "60172917206724522744580435407831004335", "30378688722491261743343452195783639086", "135256857446213728468876247704345105472", "128337708091765832135411580191428884993", "186118732364553440545191216726505730065"], "threshold":0.9}, "exact_target_file_match_only":true, "id":"ASB-A-515038894-b351f5a4", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/f840119d646c05edb7880c9f1276f92aa1c4736b", "target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/BundlePolicySerializer.java"}}, {"deprecated":false, "digest":{"line_hashes":["326702412561026300024393815901295686604", "156472992673584159090915524232794286114", "334149357670228648920450111726280653985", "313631074303561151230177818364313802212"], "threshold":0.9}, "id":"ASB-A-515038894-ee6deacf", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/f840119d646c05edb7880c9f1276f92aa1c4736b", "target":{"file":"core/java/android/app/admin/BundlePolicyValue.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-11-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/c6702d96f982bc92527fae085453d83f381f4324"], "severity":"High", "spl":"2026-11-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"235811019879431439277195957215880491234", "length":46}, "id":"ASB-A-515038894-45436e5b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/c6702d96f982bc92527fae085453d83f381f4324", "target":{"file":"core/java/android/app/admin/BundlePolicyValue.java", "function":"BundlePolicyValue"}}, {"deprecated":false, "digest":{"line_hashes":["162650519800005454501044961921539234740", "204987794194783212035451606112588096894", "158218492816319073545052545840941953302", "253509162939209170374914067461442000582", "37997544194398040395011945097086673139", "7895669008674567970537792357723895015", "175579121158468716987440761551257615414", "146313485012384398407829236266616846378", "60172917206724522744580435407831004335", "30378688722491261743343452195783639086", "135256857446213728468876247704345105472", "128337708091765832135411580191428884993", "186118732364553440545191216726505730065"], "threshold":0.9}, "exact_target_file_match_only":true, "id":"ASB-A-515038894-6fb7ffa6", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/c6702d96f982bc92527fae085453d83f381f4324", "target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/BundlePolicySerializer.java"}}, {"deprecated":false, "digest":{"function_hash":"335455891683046016734286597225358668526", "length":1670}, "exact_target_file_match_only":true, "id":"ASB-A-515038894-b73d3501", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/c6702d96f982bc92527fae085453d83f381f4324", "target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/BundlePolicySerializer.java", "function":"writeBundle"}}, {"deprecated":false, "digest":{"line_hashes":["7540256208188569581567591137097669405", "276668691750191631493767332208140405609", "73866826183827145965069554117502209911", "216518533691095088994719484251726698135"], "threshold":0.9}, "id":"ASB-A-515038894-f6ca83f0", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/c6702d96f982bc92527fae085453d83f381f4324", "target":{"file":"core/java/android/app/admin/BundlePolicyValue.java"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}