{"id":"CVE-2026-49919","title":"In tt_face_colr_blend_layer of ttcolr.c, there is a possible remote code execution due to an integer overflow","summary":"In tt_face_colr_blend_layer of ttcolr.c, there is a possible remote code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not neede…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-190"],"vendor":"google","product":"android","affected":["android = 14.0","android = 15.0","android = 16.0","android = 17.0"],"published":"2026-09-08","updated":"2026-09-24","sourceUpdated":"2026-09-24T15:47:16.387","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-49919","references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-09-01","label":"security@android.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49919.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-49919"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2460423"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-49919"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49919"}],"tags":["nvd","cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00099,"epssPercentile":0.00807,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-10T03:57:38.047253Z"},"ingestedAt":"2026-09-08T19:08:49.641Z","scores":{"nvd":7.8,"vendor":5.8},"slug":"CVE-2026-49919","body":"## Overview\n\nIn tt_face_colr_blend_layer of ttcolr.c, there is a possible remote code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.\n\n## Affected\n\n- `android = 14.0`\n- `android = 15.0`\n- `android = 16.0`\n- `android = 17.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat build of OpenJDK 11 ELS, Red Hat build of OpenJDK 17, Red Hat build of OpenJDK 21, Red Hat build of OpenJDK 25, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, … · no fix planned: Red Hat Enterprise Linux 6, Red Hat build of OpenJDK 11 ELS, Red Hat build of OpenJDK 17, Red Hat build of OpenJDK 21, … · updated 2026-10-02 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49919.json)","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":201731,"id":"CVE-2026-49919","ts":1789399642989,"field":"cvss","old":null,"new":"7.8"},{"seq":201730,"id":"CVE-2026-49919","ts":1789399642989,"field":"severity","old":"none","new":"high"},{"seq":200461,"id":"CVE-2026-49919","ts":1789397270402,"field":"cvss","old":"7.8","new":null},{"seq":200460,"id":"CVE-2026-49919","ts":1789397270402,"field":"severity","old":"high","new":"none"},{"seq":198383,"id":"CVE-2026-49919","ts":1789391868984,"field":"cvss","old":null,"new":"7.8"},{"seq":198382,"id":"CVE-2026-49919","ts":1789391868984,"field":"severity","old":"none","new":"high"},{"seq":196176,"id":"CVE-2026-49919","ts":1789383522637,"field":"cvss","old":"7.8","new":null},{"seq":196175,"id":"CVE-2026-49919","ts":1789383522637,"field":"severity","old":"high","new":"none"},{"seq":195105,"id":"CVE-2026-49919","ts":1789380409053,"field":"cvss","old":null,"new":"7.8"},{"seq":195104,"id":"CVE-2026-49919","ts":1789380409053,"field":"severity","old":"none","new":"high"},{"seq":193892,"id":"CVE-2026-49919","ts":1789378389899,"field":"cvss","old":"7.8","new":null},{"seq":193891,"id":"CVE-2026-49919","ts":1789378389899,"field":"severity","old":"high","new":"none"},{"seq":192679,"id":"CVE-2026-49919","ts":1789376353687,"field":"cvss","old":null,"new":"7.8"},{"seq":192678,"id":"CVE-2026-49919","ts":1789376353687,"field":"severity","old":"none","new":"high"},{"seq":191466,"id":"CVE-2026-49919","ts":1789373290713,"field":"cvss","old":"7.8","new":null},{"seq":191465,"id":"CVE-2026-49919","ts":1789373290713,"field":"severity","old":"high","new":"none"},{"seq":190251,"id":"CVE-2026-49919","ts":1789369244765,"field":"cvss","old":null,"new":"7.8"},{"seq":190250,"id":"CVE-2026-49919","ts":1789369244765,"field":"severity","old":"none","new":"high"},{"seq":189038,"id":"CVE-2026-49919","ts":1789368170607,"field":"cvss","old":"7.8","new":null},{"seq":189037,"id":"CVE-2026-49919","ts":1789368170607,"field":"severity","old":"high","new":"none"},{"seq":187821,"id":"CVE-2026-49919","ts":1789365098435,"field":"cvss","old":null,"new":"7.8"},{"seq":187820,"id":"CVE-2026-49919","ts":1789365098435,"field":"severity","old":"none","new":"high"},{"seq":186608,"id":"CVE-2026-49919","ts":1789363155294,"field":"cvss","old":"7.8","new":null},{"seq":186607,"id":"CVE-2026-49919","ts":1789363155294,"field":"severity","old":"high","new":"none"},{"seq":185394,"id":"CVE-2026-49919","ts":1789361052743,"field":"cvss","old":null,"new":"7.8"},{"seq":185393,"id":"CVE-2026-49919","ts":1789361052743,"field":"severity","old":"none","new":"high"},{"seq":184181,"id":"CVE-2026-49919","ts":1789358056732,"field":"cvss","old":"7.8","new":null},{"seq":184180,"id":"CVE-2026-49919","ts":1789358056732,"field":"severity","old":"high","new":"none"},{"seq":182432,"id":"CVE-2026-49919","ts":1789354180355,"field":"cvss","old":null,"new":"7.8"},{"seq":182431,"id":"CVE-2026-49919","ts":1789354180355,"field":"severity","old":"none","new":"high"},{"seq":181225,"id":"CVE-2026-49919","ts":1789353038807,"field":"cvss","old":"7.8","new":null},{"seq":181224,"id":"CVE-2026-49919","ts":1789353038807,"field":"severity","old":"high","new":"none"},{"seq":180018,"id":"CVE-2026-49919","ts":1789350118760,"field":"cvss","old":null,"new":"7.8"},{"seq":180017,"id":"CVE-2026-49919","ts":1789350118760,"field":"severity","old":"none","new":"high"},{"seq":178811,"id":"CVE-2026-49919","ts":1789347993724,"field":"cvss","old":"7.8","new":null},{"seq":178810,"id":"CVE-2026-49919","ts":1789347993724,"field":"severity","old":"high","new":"none"},{"seq":177604,"id":"CVE-2026-49919","ts":1789346240701,"field":"cvss","old":null,"new":"7.8"},{"seq":177603,"id":"CVE-2026-49919","ts":1789346240701,"field":"severity","old":"none","new":"high"},{"seq":176397,"id":"CVE-2026-49919","ts":1789342908042,"field":"cvss","old":"7.8","new":null},{"seq":176396,"id":"CVE-2026-49919","ts":1789342908042,"field":"severity","old":"high","new":"none"},{"seq":175851,"id":"CVE-2026-49919","ts":1789338692326,"field":"cvss","old":null,"new":"7.8"},{"seq":175850,"id":"CVE-2026-49919","ts":1789338692326,"field":"severity","old":"none","new":"high"},{"seq":175721,"id":"CVE-2026-49919","ts":1789338512189,"field":"cvss","old":"7.8","new":null},{"seq":175720,"id":"CVE-2026-49919","ts":1789338512189,"field":"severity","old":"high","new":"none"},{"seq":174516,"id":"CVE-2026-49919","ts":1789334714683,"field":"cvss","old":null,"new":"7.8"},{"seq":174515,"id":"CVE-2026-49919","ts":1789334714683,"field":"severity","old":"none","new":"high"},{"seq":173311,"id":"CVE-2026-49919","ts":1789333396528,"field":"cvss","old":"7.8","new":null},{"seq":173310,"id":"CVE-2026-49919","ts":1789333396528,"field":"severity","old":"high","new":"none"},{"seq":172125,"id":"CVE-2026-49919","ts":1789330958056,"field":"cvss","old":null,"new":"7.8"},{"seq":172124,"id":"CVE-2026-49919","ts":1789330958056,"field":"severity","old":"none","new":"high"}]}