CVE-2026-0040: Integer Overflow
In multiple functions of ubsanthrowingruntime.cpp, there is a possible way to cause a crash due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/external/dng_sdkto a version that resolves this vulnerability.Fixed in 17-next:2026-06-01 - Upgrade
Upgrade
android/platform/external/dng_sdkto a version that resolves this vulnerability.Fixed in 15:2026-06-01 - Upgrade
Upgrade
android/platform/external/dng_sdkto a version that resolves this vulnerability.Fixed in 16:2026-06-01 - Upgrade
Upgrade
android/platform/external/dng_sdkto a version that resolves this vulnerability.Fixed in 16-qpr2:2026-06-01 - Upgrade
Upgrade
android/platform/external/dng_sdkto a version that resolves this vulnerability.Fixed in 14:2026-06-01
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0040?
The severity of CVE-2026-0040 is medium with a CVSS score of 6.5.
What software is affected by CVE-2026-0040?
CVE-2026-0040 affects Google Android and the llvm compiler-rt associated with UndefinedBehaviorSanitizer.
What type of vulnerability is CVE-2026-0040?
CVE-2026-0040 is classified as an integer overflow vulnerability that can cause a crash.
What impact does CVE-2026-0040 have on affected systems?
CVE-2026-0040 can lead to a remote denial of service without requiring additional execution privileges or user interaction.
How do I mitigate CVE-2026-0040?
To mitigate CVE-2026-0040, it is recommended to apply updates or patches provided by the software vendor.