CVE-2026-0014: Input Validation

Published Mar 2, 2026

Updated

In isPackageNullOrSystem of AppOpsService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Software

6 affected components

Google Android=14.0

Google Android=15.0

Google Android=16.0

Google Android=16.0-qpr2_beta_1

Google Android=16.0-qpr2_beta_2

Google Android=16.0-qpr2_beta_3

Event History

Mar 2, 2026

CVE Published

via MITRE·06:42 PM

Data Sourced

via MITRE·06:42 PM

DescriptionWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-0014?

CVE-2026-0014 is classified as a denial of service vulnerability, which can cause a local denial of service condition.

How do I fix CVE-2026-0014?

To mitigate CVE-2026-0014, it is recommended to update your device to the latest version of Android that addresses this vulnerability.

What versions of Android are affected by CVE-2026-0014?

CVE-2026-0014 affects Android versions 14.0, 15.0, and 16.0 including specific beta releases of 16.0.

Is user interaction required to exploit CVE-2026-0014?

No, exploitation of CVE-2026-0014 does not require user interaction.

What might be the impact of CVE-2026-0014?

The impact of CVE-2026-0014 is a persistent denial of service, which can disrupt normal operation of the affected device.