Vulnerability-Lookup

CVE-2026-0049 (GCVE-0-2026-0049)

Vulnerability from cvelistv5 – Published: 2026-04-06 18:20 – Updated: 2026-04-06 18:39

Summary

In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

Severity ?

6.2 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

Denial of service

Assigner

google_android

References

URL

Tags

https://source.android.com/docs/security/bulletin…

vendor-advisory

Impacted products

	Vendor	Product	Version
	Google	Android	Affected: 16-qpr2 Affected: 16 Affected: 15 Affected: 14

Date Public ?

2026-04-05 18:30

Credits

Cxxsheng (曹圣) and Yanjie Zhao (赵彦杰) of Huazhong University of Science and Technology (华中科技大学) and Canyie(石松洲) of LSPosed Team.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.2,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-0049",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-06T18:39:39.296981Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-06T18:39:43.404Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Android",
          "vendor": "Google",
          "versions": [
            {
              "status": "affected",
              "version": "16-qpr2"
            },
            {
              "status": "affected",
              "version": "16"
            },
            {
              "status": "affected",
              "version": "15"
            },
            {
              "status": "affected",
              "version": "14"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Cxxsheng (\u66f9\u5723) and Yanjie Zhao (\u8d75\u5f66\u6770) of Huazhong University of Science and Technology (\u534e\u4e2d\u79d1\u6280\u5927\u5b66) and Canyie(\u77f3\u677e\u6d32) of LSPosed Team."
        }
      ],
      "datePublic": "2026-04-05T18:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.\u003c/p\u003e"
            }
          ],
          "value": "In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Denial of service",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-06T18:32:39.782Z",
        "orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
        "shortName": "google_android"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://source.android.com/docs/security/bulletin/2026/2026-04-01"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "cvelib 1.7.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
    "assignerShortName": "google_android",
    "cveId": "CVE-2026-0049",
    "datePublished": "2026-04-06T18:20:38.337Z",
    "dateReserved": "2025-10-15T15:39:42.902Z",
    "dateUpdated": "2026-04-06T18:39:43.404Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-0049\",\"sourceIdentifier\":\"security@android.com\",\"published\":\"2026-04-06T19:16:26.280\",\"lastModified\":\"2026-04-10T18:54:40.540\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":6.2,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-400\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2700BCC5-634D-4EC6-AB67-5B678D5F951D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8538774C-906D-4B03-A3E7-FA7A55E0DA9E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"02882AB1-7993-47DD-84A0-8DF4272D85ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:google:android:16.0:qpr2_beta_1:*:*:*:*:*:*\",\"matchCriteriaId\":\"FD695F32-4A73-4846-B1A1-04FF266E9C15\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:google:android:16.0:qpr2_beta_2:*:*:*:*:*:*\",\"matchCriteriaId\":\"3DE9F018-8704-476B-8D59-F63F8486E231\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:google:android:16.0:qpr2_beta_3:*:*:*:*:*:*\",\"matchCriteriaId\":\"BE95A642-4330-4F65-B028-3BA597D30F32\"}]}]}],\"references\":[{\"url\":\"https://source.android.com/docs/security/bulletin/2026/2026-04-01\",\"source\":\"security@android.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.2, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-0049\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-06T18:39:39.296981Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-400\", \"description\": \"CWE-400 Uncontrolled Resource Consumption\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-06T18:39:33.329Z\"}}], \"cna\": {\"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Cxxsheng (\\u66f9\\u5723) and Yanjie Zhao (\\u8d75\\u5f66\\u6770) of Huazhong University of Science and Technology (\\u534e\\u4e2d\\u79d1\\u6280\\u5927\\u5b66) and Canyie(\\u77f3\\u677e\\u6d32) of LSPosed Team.\"}], \"affected\": [{\"vendor\": \"Google\", \"product\": \"Android\", \"versions\": [{\"status\": \"affected\", \"version\": \"16-qpr2\"}, {\"status\": \"affected\", \"version\": \"16\"}, {\"status\": \"affected\", \"version\": \"15\"}, {\"status\": \"affected\", \"version\": \"14\"}], \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2026-04-05T18:30:00.000Z\", \"references\": [{\"url\": \"https://source.android.com/docs/security/bulletin/2026/2026-04-01\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"cvelib 1.7.1\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eIn onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"Denial of service\"}]}], \"providerMetadata\": {\"orgId\": \"baff130e-b8d5-4e15-b3d3-c3cf5d5545c6\", \"shortName\": \"google_android\", \"dateUpdated\": \"2026-04-06T18:32:39.782Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-0049\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-06T18:39:43.404Z\", \"dateReserved\": \"2025-10-15T15:39:42.902Z\", \"assignerOrgId\": \"baff130e-b8d5-4e15-b3d3-c3cf5d5545c6\", \"datePublished\": \"2026-04-06T18:20:38.337Z\", \"assignerShortName\": \"google_android\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-0049

Vulnerability from fkie_nvd - Published: 2026-04-06 19:16 - Updated: 2026-04-07 13:20

Severity ?

6.2 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	security@android.com	https://source.android.com/docs/security/bulletin/2026/2026-04-01

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation."
    }
  ],
  "id": "CVE-2026-0049",
  "lastModified": "2026-04-07T13:20:11.643",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 6.2,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-04-06T19:16:26.280",
  "references": [
    {
      "source": "security@android.com",
      "url": "https://source.android.com/docs/security/bulletin/2026/2026-04-01"
    }
  ],
  "sourceIdentifier": "security@android.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-HXFH-7372-Q4FF

Vulnerability from github – Published: 2026-04-06 21:31 – Updated: 2026-04-06 21:31

Details

Severity ?

6.2 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-0049"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-06T19:16:26Z",
    "severity": "MODERATE"
  },
  "details": "In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.",
  "id": "GHSA-hxfh-7372-q4ff",
  "modified": "2026-04-06T21:31:34Z",
  "published": "2026-04-06T21:31:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0049"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/docs/security/bulletin/2026/2026-04-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CERTFR-2026-AVI-0399

Vulnerability from certfr_avis - Published: 2026-04-07 - Updated: 2026-04-07

De multiples vulnérabilités ont été découvertes dans Google Android. Elles permettent à un attaquant de provoquer un déni de service et un problème de sécurité non spécifié par l'éditeur.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Google	N/A	Android versions antérieures à 14, 15, 16 et 16-qpr2 avant le correctif du 6 avril 2026

References

Title

Publication Time

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-0049 (GCVE-0-2026-0049)

FKIE_CVE-2026-0049

GHSA-HXFH-7372-Q4FF

CERTFR-2026-AVI-0399

Solutions

Tags

Sightings

Nomenclature