CVE-2026-0064: Critical severity Google Android vulnerability
In multiple places, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Apply system-level resource limits to prevent resource exhaustion (for example: configure per-process quotas or cgroups/containers on Linux, Job Objects/Windows Resource Controls on Windows) so a single process cannot consume all system resources and cause a persistent local denial of service.
- Compensating control
Deploy monitoring and automated recovery (watchdog) for the affected process/service to detect excessive resource usage and automatically restart or recycle the process before it leads to a persistent DoS.
- Compensating control
Enforce least-privilege and restrict local execution: limit which local accounts can execute the software, restrict access to untrusted users, and isolate the service (e.g., run in a container or restricted user account) to reduce the likelihood of local exploitation leading to DoS.
- Operational
If resource exhaustion is observed, clear the condition by restarting the affected process or host, capture diagnostic logs and resource usage metrics, and perform a root-cause investigation to identify the triggering workload or input.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0064?
The severity of CVE-2026-0064 is classified as critical with a CVSS score of 10.
How do I fix CVE-2026-0064?
To fix CVE-2026-0064, update your Google Android software to the latest security patch that addresses this vulnerability.
What are the potential impacts of CVE-2026-0064?
CVE-2026-0064 can result in a persistent denial of service due to resource exhaustion, affecting system performance.
Is user interaction required to exploit CVE-2026-0064?
No, user interaction is not required for the exploitation of CVE-2026-0064.
Who is affected by CVE-2026-0064?
CVE-2026-0064 affects devices running Google Android that have not been updated to mitigate this vulnerability.