{"id":"ASB-A-517376786", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-05T16:32:28.703711716Z", "aliases":["CVE-2026-59005", "A-517376786"], "details":"In insertInternal of MmsProvider.java, there is a possible multiuser isolation issue due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/providers/TelephonyProvider", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/a8cf618a797f4b8c33f95434cfff24b71b3a9cd1"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"156214849804644347597254707875373008715", "length":8559}, "id":"ASB-A-517376786-4bade822", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/a8cf618a797f4b8c33f95434cfff24b71b3a9cd1", "target":{"file":"src/com/android/providers/telephony/MmsProvider.java", "function":"insertInternal"}}, {"deprecated":false, "digest":{"line_hashes":["165371737858798706378303122491344422635", "337113786514798246550929904010334383677", "202560627648877130884950799589197573911", "255747255188442027712064021564349237025", "11757165687787717149171992205205690414", "227306064171168161586737224694258482162", "337168207884483463151619114809820328521", "153270524520431711887192973279136181317", "15313585826727891874419835252423641571", "232248485004137106877293995326816625047"], "threshold":0.9}, "id":"ASB-A-517376786-87869f86", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/a8cf618a797f4b8c33f95434cfff24b71b3a9cd1", "target":{"file":"src/com/android/providers/telephony/MmsProvider.java"}}]}}, {"package":{"name":"platform/packages/providers/TelephonyProvider", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-11-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/771fd8dd05872c5e33f66c8074ee4ee9483f8db0"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["165371737858798706378303122491344422635", "337113786514798246550929904010334383677", "202560627648877130884950799589197573911", "255747255188442027712064021564349237025", "11757165687787717149171992205205690414", "227306064171168161586737224694258482162", "337168207884483463151619114809820328521", "153270524520431711887192973279136181317", "15313585826727891874419835252423641571", "232248485004137106877293995326816625047"], "threshold":0.9}, "id":"ASB-A-517376786-7cfe39e8", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/771fd8dd05872c5e33f66c8074ee4ee9483f8db0", "target":{"file":"src/com/android/providers/telephony/MmsProvider.java"}}, {"deprecated":false, "digest":{"function_hash":"153315484966539126586283227221069750606", "length":7953}, "id":"ASB-A-517376786-ee8d2d81", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/771fd8dd05872c5e33f66c8074ee4ee9483f8db0", "target":{"file":"src/com/android/providers/telephony/MmsProvider.java", "function":"insert"}}]}}, {"package":{"name":"platform/packages/providers/TelephonyProvider", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-11-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/b7537470465c6d926b2233f77e10db8e907868e5"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["165371737858798706378303122491344422635", "337113786514798246550929904010334383677", "202560627648877130884950799589197573911", "255747255188442027712064021564349237025", "11757165687787717149171992205205690414", "227306064171168161586737224694258482162", "337168207884483463151619114809820328521", "153270524520431711887192973279136181317", "15313585826727891874419835252423641571", "232248485004137106877293995326816625047"], "threshold":0.9}, "id":"ASB-A-517376786-9ca8b79c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/b7537470465c6d926b2233f77e10db8e907868e5", "target":{"file":"src/com/android/providers/telephony/MmsProvider.java"}}, {"deprecated":false, "digest":{"function_hash":"153315484966539126586283227221069750606", "length":7953}, "id":"ASB-A-517376786-b2bc2461", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/b7537470465c6d926b2233f77e10db8e907868e5", "target":{"file":"src/com/android/providers/telephony/MmsProvider.java", "function":"insert"}}]}}, {"package":{"name":"platform/packages/providers/TelephonyProvider", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-11-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/8f1a95aedc16a6cf4e5e962bf48ca2513292b283"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"153315484966539126586283227221069750606", "length":7953}, "id":"ASB-A-517376786-99aa8ee6", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/8f1a95aedc16a6cf4e5e962bf48ca2513292b283", "target":{"file":"src/com/android/providers/telephony/MmsProvider.java", "function":"insert"}}, {"deprecated":false, "digest":{"line_hashes":["165371737858798706378303122491344422635", "337113786514798246550929904010334383677", "202560627648877130884950799589197573911", "255747255188442027712064021564349237025", "11757165687787717149171992205205690414", "227306064171168161586737224694258482162", "337168207884483463151619114809820328521", "153270524520431711887192973279136181317", "15313585826727891874419835252423641571", "232248485004137106877293995326816625047"], "threshold":0.9}, "id":"ASB-A-517376786-d98722f3", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/8f1a95aedc16a6cf4e5e962bf48ca2513292b283", "target":{"file":"src/com/android/providers/telephony/MmsProvider.java"}}]}}, {"package":{"name":"platform/packages/providers/TelephonyProvider", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-11-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/ccf87fea96d876563a91550908cc52f7e875de2c"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["165371737858798706378303122491344422635", "337113786514798246550929904010334383677", "202560627648877130884950799589197573911", "255747255188442027712064021564349237025", "11757165687787717149171992205205690414", "227306064171168161586737224694258482162", "337168207884483463151619114809820328521", "153270524520431711887192973279136181317", "15313585826727891874419835252423641571", "232248485004137106877293995326816625047"], "threshold":0.9}, "id":"ASB-A-517376786-3f49016b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/ccf87fea96d876563a91550908cc52f7e875de2c", "target":{"file":"src/com/android/providers/telephony/MmsProvider.java"}}, {"deprecated":false, "digest":{"function_hash":"324523338053235110153682363310365262332", "length":8334}, "id":"ASB-A-517376786-fc9870b7", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/ccf87fea96d876563a91550908cc52f7e875de2c", "target":{"file":"src/com/android/providers/telephony/MmsProvider.java", "function":"insertInternal"}}]}}, {"package":{"name":"platform/packages/providers/TelephonyProvider", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-11-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/3bd751036480b5587c35b31ca8793d522a182d2b"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["165371737858798706378303122491344422635", "304894902118299150232926326351325832172", "177721061964733622234952234161315065779", "130520461954754438968923716599721739349", "285474766999274130503098498639136895708", "227306064171168161586737224694258482162", "337168207884483463151619114809820328521", "153270524520431711887192973279136181317", "15313585826727891874419835252423641571", "232248485004137106877293995326816625047"], "threshold":0.9}, "id":"ASB-A-517376786-a1643215", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/3bd751036480b5587c35b31ca8793d522a182d2b", "target":{"file":"src/com/android/providers/telephony/MmsProvider.java"}}, {"deprecated":false, "digest":{"function_hash":"81514773691457344119100015963312189187", "length":7501}, "id":"ASB-A-517376786-fc3db5c4", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/3bd751036480b5587c35b31ca8793d522a182d2b", "target":{"file":"src/com/android/providers/telephony/MmsProvider.java", "function":"insert"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}