CVE-2026-0056: Low severity Google Android vulnerability
In setTo of ResourceTypes.cpp, there is a possible read out of bounds due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict local access to systems and accounts that can execute the affected binary/component. Limit who can log in locally, enforce strict file permissions and ACLs on the binary and related files so only trusted administrators can read or execute them, and remove unnecessary local user accounts.
- Compensating control
Isolate or sandbox the affected component/process to reduce impact of a local information disclosure (for example run it in a container, VM, or confined environment and apply OS-level confinement such as seccomp, AppArmor, or SELinux policies).
- Operational
Assume sensitive local information may have been exposed; audit logs for signs of local access to the component, and rotate any secrets or credentials that could have been disclosed if exposure is suspected.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0056?
The severity of CVE-2026-0056 is classified as low with a CVSS score of 3.3.
What does CVE-2026-0056 affect?
CVE-2026-0056 affects Google Android due to an incorrect bounds check in setTo of ResourceTypes.cpp.
What could happen if CVE-2026-0056 is exploited?
Exploitation of CVE-2026-0056 could lead to local information disclosure without requiring any additional execution privileges.
Is user interaction required to exploit CVE-2026-0056?
No, user interaction is not needed for the exploitation of CVE-2026-0056.
How can I mitigate the risks associated with CVE-2026-0056?
To mitigate risks from CVE-2026-0056, ensure that you are using the latest version of Google Android that addresses this vulnerability.