CVE-2026-0016: [NotCVE-2026-0016] game-music-emu VGM Command Interpter Unvalidated 0xE0 PCM Seek Offset Allows Out-of-Bounds ad and Denial of Service
In updateProvidersWhenServiceRemoved of CredentialManagerService.java, there is a possible way to override settings across users due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 17-next:2026-06-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 16:2026-06-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 16-qpr2:2026-06-01
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0016?
The severity of CVE-2026-0016 is classified as low, with a CVSS score of 3.3.
What type of exposure does CVE-2026-0016 allow?
CVE-2026-0016 allows for local information disclosure due to a permissions bypass.
Is user interaction required to exploit CVE-2026-0016?
No, user interaction is not needed to exploit CVE-2026-0016.
Which software is affected by CVE-2026-0016?
CVE-2026-0016 affects Google Android and the Google Android CredentialManagerService.
How can I mitigate the risks associated with CVE-2026-0016?
At this time, review your permissions and ensure your system is updated to eliminate the risks associated with CVE-2026-0016.