CVE-2026-28575: Critical severity Google Android vulnerability
In PackageInstaller.Session#transfer of frameworks/base/services/core/java/com/android/server/pm/PackageInstallerSession.java, there is a possible memory exhaustion attack due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28575?
CVE-2026-28575 has a critical severity rating of 10.
What type of vulnerability is CVE-2026-28575?
CVE-2026-28575 is classified as a deniable access vulnerability due to a memory exhaustion attack.
How can I mitigate the risks associated with CVE-2026-28575?
To mitigate CVE-2026-28575, it is recommended to apply the latest security updates provided by Google Android.
Who is affected by CVE-2026-28575?
CVE-2026-28575 affects users of Google Android that utilize the impacted PackageInstaller.Session functionality.
What are the consequences of exploiting CVE-2026-28575?
Exploiting CVE-2026-28575 may lead to a local denial of service without needing additional execution privileges.