{"id":"ASB-A-515712425", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-02T16:38:00.081625681Z", "aliases":["CVE-2026-58964", "A-515712425"], "details":"In checkDestination of SmsUsageMonitor.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/opt/telephony", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/e6e62211da4f9ee2fa644ea02b607edc9f3cae8c"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"296638958761094864193970183462327384912", "length":1439}, "id":"ASB-A-515712425-127ab9f7", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/e6e62211da4f9ee2fa644ea02b607edc9f3cae8c", "target":{"file":"src/java/com/android/internal/telephony/SmsUsageMonitor.java", "function":"checkDestination"}}, {"deprecated":false, "digest":{"line_hashes":["278866342898281575859739499010048378672", "152653872370625791126753809537305123347", "323696478722054455160265477005009271833", "105980278909833987128848098333978565198"], "threshold":0.9}, "id":"ASB-A-515712425-5dd221d5", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/e6e62211da4f9ee2fa644ea02b607edc9f3cae8c", "target":{"file":"src/java/com/android/internal/telephony/SmsUsageMonitor.java"}}]}}, {"package":{"name":"platform/frameworks/opt/telephony", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-11-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/c14a3539fd92fa8c64ad3790a06a31c6292ad73c"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"198002522420519632856240698289617733578", "length":1359}, "id":"ASB-A-515712425-34bb4a8b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/c14a3539fd92fa8c64ad3790a06a31c6292ad73c", "target":{"file":"src/java/com/android/internal/telephony/SmsUsageMonitor.java", "function":"checkDestination"}}, {"deprecated":false, "digest":{"line_hashes":["278866342898281575859739499010048378672", "152653872370625791126753809537305123347", "21595000393728852658924036448522328509", "184071510294647729346726695068691204073"], "threshold":0.9}, "id":"ASB-A-515712425-418b2ceb", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/c14a3539fd92fa8c64ad3790a06a31c6292ad73c", "target":{"file":"src/java/com/android/internal/telephony/SmsUsageMonitor.java"}}]}}, {"package":{"name":"platform/frameworks/opt/telephony", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-11-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/451ccf296b4e3381253f2de2cb4b6984cdfee4ce"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"296638958761094864193970183462327384912", "length":1439}, "id":"ASB-A-515712425-61dbab93", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/451ccf296b4e3381253f2de2cb4b6984cdfee4ce", "target":{"file":"src/java/com/android/internal/telephony/SmsUsageMonitor.java", "function":"checkDestination"}}, {"deprecated":false, "digest":{"line_hashes":["278866342898281575859739499010048378672", "152653872370625791126753809537305123347", "323696478722054455160265477005009271833", "105980278909833987128848098333978565198"], "threshold":0.9}, "id":"ASB-A-515712425-d41b1150", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/451ccf296b4e3381253f2de2cb4b6984cdfee4ce", "target":{"file":"src/java/com/android/internal/telephony/SmsUsageMonitor.java"}}]}}, {"package":{"name":"platform/frameworks/opt/telephony", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-11-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/6cca82ff4c2741e4ce5c58d768101ea9851c3d27"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["278866342898281575859739499010048378672", "152653872370625791126753809537305123347", "323696478722054455160265477005009271833", "105980278909833987128848098333978565198"], "threshold":0.9}, "id":"ASB-A-515712425-222e6b81", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/6cca82ff4c2741e4ce5c58d768101ea9851c3d27", "target":{"file":"src/java/com/android/internal/telephony/SmsUsageMonitor.java"}}, {"deprecated":false, "digest":{"function_hash":"296638958761094864193970183462327384912", "length":1439}, "id":"ASB-A-515712425-e01945e4", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/6cca82ff4c2741e4ce5c58d768101ea9851c3d27", "target":{"file":"src/java/com/android/internal/telephony/SmsUsageMonitor.java", "function":"checkDestination"}}]}}, {"package":{"name":"platform/frameworks/opt/telephony", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-11-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/ef002f31e460aa468906812aa152d6ea693b9ce7"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["278866342898281575859739499010048378672", "152653872370625791126753809537305123347", "323696478722054455160265477005009271833", "105980278909833987128848098333978565198"], "threshold":0.9}, "id":"ASB-A-515712425-4be6b7e2", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/ef002f31e460aa468906812aa152d6ea693b9ce7", "target":{"file":"src/java/com/android/internal/telephony/SmsUsageMonitor.java"}}, {"deprecated":false, "digest":{"function_hash":"296638958761094864193970183462327384912", "length":1439}, "id":"ASB-A-515712425-c3902513", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/ef002f31e460aa468906812aa152d6ea693b9ce7", "target":{"file":"src/java/com/android/internal/telephony/SmsUsageMonitor.java", "function":"checkDestination"}}]}}, {"package":{"name":"platform/frameworks/opt/telephony", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-11-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/c6b9fd188c377c2a2ec5b579be0e5e877137acb9"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["278866342898281575859739499010048378672", "152653872370625791126753809537305123347", "21595000393728852658924036448522328509", "184071510294647729346726695068691204073"], "threshold":0.9}, "id":"ASB-A-515712425-491ef46d", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/c6b9fd188c377c2a2ec5b579be0e5e877137acb9", "target":{"file":"src/java/com/android/internal/telephony/SmsUsageMonitor.java"}}, {"deprecated":false, "digest":{"function_hash":"198002522420519632856240698289617733578", "length":1359}, "id":"ASB-A-515712425-ba1a8ba5", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/c6b9fd188c377c2a2ec5b579be0e5e877137acb9", "target":{"file":"src/java/com/android/internal/telephony/SmsUsageMonitor.java", "function":"checkDestination"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}