CVE-2026-0049

MEDIUM

Android - Denial of Service via LocalImageResolver Header Decoding

Title source: llm

Description

In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

References (1)

Core 1

Core References

Vendor Advisory vendor-advisory

https://source.android.com/docs/security/bulletin/2026/2026-04-01

Scores

CVSS v3 6.2

EPSS 0.0010

EPSS Percentile 1.1%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-400

Status published

Products (7)

google/android 14.0

google/android 15.0

google/android 16.0 (4 CPE variants)

Google/Android 14

Google/Android 15

Google/Android 16

Google/Android 16-qpr2

Published Apr 06, 2026

Tracked Since Apr 07, 2026