CVE-2026-0049

MEDIUM

Google Android < 16-qpr2 - Denial of Service

Title source: rule
STIX 2.1

Description

In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

References (1)

Scores

CVSS v3 6.2
EPSS 0.0001
EPSS Percentile 0.5%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-400
Status published
Products (7)
google/android 14.0
google/android 15.0
google/android 16.0 (4 CPE variants)
Google/Android 14
Google/Android 15
Google/Android 16
Google/Android 16-qpr2
Published Apr 06, 2026
Tracked Since Apr 07, 2026