ASB-A-501447778

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-501447778.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-501447778
Aliases
  • A-501447778
  • CVE-2026-28666
Published
2026-09-01T00:00:00Z
Modified
2026-09-09T15:15:54Z
Summary
[none]
Details

In multiple functions of LocalImageResolver.java, there is a possible Remote Persistent Denial of Service due to a DNG image rendering check bypass. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-next:0
Fixed
17-next:2026-09-01

Affected versions

Other
17-next

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/ea59bf7683410de0cb9fe57ff3c56bd5b39d7d7e",
        "https://android.googlesource.com/platform/frameworks/base/+/23799d7017ce40bed6d78dbd7595ff176b48bc8b"
    ],
    "severity": "Critical",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "181779492444834365844778119335346448964",
                "length": 837
            },
            "id": "ASB-A-501447778-0ae84b3f",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/ea59bf7683410de0cb9fe57ff3c56bd5b39d7d7e",
            "target": {
                "file": "core/java/com/android/internal/widget/LocalImageResolver.java",
                "function": "resolveImage"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "259615616814576999863751968031017701462",
                    "139909294273499117641436918074668974027",
                    "339369719644469653010724501905577675975",
                    "232071457955885568070084688025172819375",
                    "225926407366653861141125291681678342297",
                    "213008522495646628192596065558322107404",
                    "10036313730060407437412516506734674823",
                    "143471472001310313212702210723494825867",
                    "211982424676714602568669030251340215025",
                    "122022361506936548721657756885246230300",
                    "246830623291359353466295982805824052755",
                    "203661984909155791185733485882463201680",
                    "134182420467732203499480077612593495555",
                    "213368203140904731727178224429241062219",
                    "148225270485517718906329976952177729537",
                    "60867849361854279714501507875730397311",
                    "129499696879507256912651552967260195048"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-501447778-5462629b",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/ea59bf7683410de0cb9fe57ff3c56bd5b39d7d7e",
            "target": {
                "file": "core/java/com/android/internal/widget/LocalImageResolver.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "84770000407260855850997646054532109453",
                "length": 857
            },
            "id": "ASB-A-501447778-574c2f71",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/23799d7017ce40bed6d78dbd7595ff176b48bc8b",
            "target": {
                "file": "core/java/com/android/internal/widget/LocalImageResolver.java",
                "function": "resolveImage"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "138316194826753610241098808139202362662",
                "length": 1042
            },
            "id": "ASB-A-501447778-a4801a92",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/ea59bf7683410de0cb9fe57ff3c56bd5b39d7d7e",
            "target": {
                "file": "core/java/com/android/internal/widget/LocalImageResolver.java",
                "function": "onHeaderDecoded"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "142318132660448244596666380013593433679",
                    "208726728939143904319120274308576416277",
                    "23686511696894709866346397045748315673",
                    "65333525003484184487365139394950227018",
                    "225926407366653861141125291681678342297",
                    "248973725219518955435762673770412228973",
                    "240877631179777638639046522688214779546",
                    "286781409708266251750161595945958659475",
                    "221605527259751044431630177553344833207",
                    "163030337801298817673220452038765106381",
                    "88412822220008543630676450736551268724",
                    "72545789367658983850124713650698414849"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-501447778-b7e28355",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/23799d7017ce40bed6d78dbd7595ff176b48bc8b",
            "target": {
                "file": "core/java/com/android/internal/widget/LocalImageResolver.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "327375112703721220455359273499929644922",
                "length": 369
            },
            "id": "ASB-A-501447778-d49d66a9",
            "match_only_versions": [
                "17-next"
            ],
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/23799d7017ce40bed6d78dbd7595ff176b48bc8b",
            "target": {
                "file": "core/java/com/android/internal/widget/LocalImageResolver.java",
                "function": "onHeaderDecoded"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "8343066837056042004928488437492206078",
                "length": 769
            },
            "id": "ASB-A-501447778-e3cb9aa3",
            "match_only_versions": [
                "17-next"
            ],
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/23799d7017ce40bed6d78dbd7595ff176b48bc8b",
            "target": {
                "file": "core/java/com/android/internal/widget/LocalImageResolver.java",
                "function": "checkHeader"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-501447778.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2026-09-01

Affected versions

Other
15

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/c3f25eaf01699da0d6cde92973030e73bd347958"
    ],
    "severity": "Critical",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "138316194826753610241098808139202362662",
                "length": 1042
            },
            "id": "ASB-A-501447778-1af430bd",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/c3f25eaf01699da0d6cde92973030e73bd347958",
            "target": {
                "file": "core/java/com/android/internal/widget/LocalImageResolver.java",
                "function": "onHeaderDecoded"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "181779492444834365844778119335346448964",
                "length": 837
            },
            "id": "ASB-A-501447778-27db4f76",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/c3f25eaf01699da0d6cde92973030e73bd347958",
            "target": {
                "file": "core/java/com/android/internal/widget/LocalImageResolver.java",
                "function": "resolveImage"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "259615616814576999863751968031017701462",
                    "139909294273499117641436918074668974027",
                    "339369719644469653010724501905577675975",
                    "232071457955885568070084688025172819375",
                    "142318132660448244596666380013593433679",
                    "208726728939143904319120274308576416277",
                    "23686511696894709866346397045748315673",
                    "65333525003484184487365139394950227018",
                    "225926407366653861141125291681678342297",
                    "213008522495646628192596065558322107404",
                    "10036313730060407437412516506734674823",
                    "143471472001310313212702210723494825867",
                    "211982424676714602568669030251340215025",
                    "122022361506936548721657756885246230300",
                    "246830623291359353466295982805824052755",
                    "203661984909155791185733485882463201680",
                    "134182420467732203499480077612593495555",
                    "213368203140904731727178224429241062219",
                    "148225270485517718906329976952177729537",
                    "60867849361854279714501507875730397311",
                    "129499696879507256912651552967260195048"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-501447778-ddf11f02",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/c3f25eaf01699da0d6cde92973030e73bd347958",
            "target": {
                "file": "core/java/com/android/internal/widget/LocalImageResolver.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-501447778.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-09-01

Affected versions

Other
16

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/481a08c680c66c0a8334e1ac0e15a461306acce3"
    ],
    "severity": "Critical",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "181779492444834365844778119335346448964",
                "length": 837
            },
            "id": "ASB-A-501447778-1218ab64",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/481a08c680c66c0a8334e1ac0e15a461306acce3",
            "target": {
                "file": "core/java/com/android/internal/widget/LocalImageResolver.java",
                "function": "resolveImage"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "259615616814576999863751968031017701462",
                    "139909294273499117641436918074668974027",
                    "339369719644469653010724501905577675975",
                    "232071457955885568070084688025172819375",
                    "142318132660448244596666380013593433679",
                    "208726728939143904319120274308576416277",
                    "23686511696894709866346397045748315673",
                    "65333525003484184487365139394950227018",
                    "225926407366653861141125291681678342297",
                    "213008522495646628192596065558322107404",
                    "10036313730060407437412516506734674823",
                    "143471472001310313212702210723494825867",
                    "211982424676714602568669030251340215025",
                    "122022361506936548721657756885246230300",
                    "246830623291359353466295982805824052755",
                    "203661984909155791185733485882463201680",
                    "134182420467732203499480077612593495555",
                    "213368203140904731727178224429241062219",
                    "148225270485517718906329976952177729537",
                    "60867849361854279714501507875730397311",
                    "129499696879507256912651552967260195048"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-501447778-bc568b43",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/481a08c680c66c0a8334e1ac0e15a461306acce3",
            "target": {
                "file": "core/java/com/android/internal/widget/LocalImageResolver.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "138316194826753610241098808139202362662",
                "length": 1042
            },
            "id": "ASB-A-501447778-c4594353",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/481a08c680c66c0a8334e1ac0e15a461306acce3",
            "target": {
                "file": "core/java/com/android/internal/widget/LocalImageResolver.java",
                "function": "onHeaderDecoded"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-501447778.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-09-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/eaaabc00153ce36cbb20e54cb9b6ed3037cdf3d2"
    ],
    "severity": "Critical",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "259615616814576999863751968031017701462",
                    "139909294273499117641436918074668974027",
                    "339369719644469653010724501905577675975",
                    "232071457955885568070084688025172819375",
                    "142318132660448244596666380013593433679",
                    "208726728939143904319120274308576416277",
                    "23686511696894709866346397045748315673",
                    "65333525003484184487365139394950227018",
                    "225926407366653861141125291681678342297",
                    "213008522495646628192596065558322107404",
                    "10036313730060407437412516506734674823",
                    "143471472001310313212702210723494825867",
                    "211982424676714602568669030251340215025",
                    "122022361506936548721657756885246230300",
                    "246830623291359353466295982805824052755",
                    "203661984909155791185733485882463201680",
                    "134182420467732203499480077612593495555",
                    "213368203140904731727178224429241062219",
                    "148225270485517718906329976952177729537",
                    "60867849361854279714501507875730397311",
                    "129499696879507256912651552967260195048"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-501447778-5c9fcbcc",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/eaaabc00153ce36cbb20e54cb9b6ed3037cdf3d2",
            "target": {
                "file": "core/java/com/android/internal/widget/LocalImageResolver.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "138316194826753610241098808139202362662",
                "length": 1042
            },
            "id": "ASB-A-501447778-6585bff5",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/eaaabc00153ce36cbb20e54cb9b6ed3037cdf3d2",
            "target": {
                "file": "core/java/com/android/internal/widget/LocalImageResolver.java",
                "function": "onHeaderDecoded"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "181779492444834365844778119335346448964",
                "length": 837
            },
            "id": "ASB-A-501447778-7f19edf8",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/eaaabc00153ce36cbb20e54cb9b6ed3037cdf3d2",
            "target": {
                "file": "core/java/com/android/internal/widget/LocalImageResolver.java",
                "function": "resolveImage"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-501447778.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17:0
Fixed
17:2026-09-01

Affected versions

Other
17

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/8653c76b7af1b66bcf98dfb277b5cfa17ea72008"
    ],
    "severity": "Critical",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "138316194826753610241098808139202362662",
                "length": 1042
            },
            "id": "ASB-A-501447778-aa98025e",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/8653c76b7af1b66bcf98dfb277b5cfa17ea72008",
            "target": {
                "file": "core/java/com/android/internal/widget/LocalImageResolver.java",
                "function": "onHeaderDecoded"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "181779492444834365844778119335346448964",
                "length": 837
            },
            "id": "ASB-A-501447778-b817120f",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/8653c76b7af1b66bcf98dfb277b5cfa17ea72008",
            "target": {
                "file": "core/java/com/android/internal/widget/LocalImageResolver.java",
                "function": "resolveImage"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "259615616814576999863751968031017701462",
                    "139909294273499117641436918074668974027",
                    "339369719644469653010724501905577675975",
                    "232071457955885568070084688025172819375",
                    "142318132660448244596666380013593433679",
                    "208726728939143904319120274308576416277",
                    "23686511696894709866346397045748315673",
                    "65333525003484184487365139394950227018",
                    "225926407366653861141125291681678342297",
                    "213008522495646628192596065558322107404",
                    "10036313730060407437412516506734674823",
                    "143471472001310313212702210723494825867",
                    "211982424676714602568669030251340215025",
                    "122022361506936548721657756885246230300",
                    "246830623291359353466295982805824052755",
                    "203661984909155791185733485882463201680",
                    "134182420467732203499480077612593495555",
                    "213368203140904731727178224429241062219",
                    "148225270485517718906329976952177729537",
                    "60867849361854279714501507875730397311",
                    "129499696879507256912651552967260195048"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-501447778-b885bb7f",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/8653c76b7af1b66bcf98dfb277b5cfa17ea72008",
            "target": {
                "file": "core/java/com/android/internal/widget/LocalImageResolver.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-501447778.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2026-09-01

Affected versions

Other
14

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/dacded6e58912740e50c05264c21b609ab70f1c3"
    ],
    "severity": "Critical",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "259615616814576999863751968031017701462",
                    "139909294273499117641436918074668974027",
                    "339369719644469653010724501905577675975",
                    "232071457955885568070084688025172819375",
                    "142318132660448244596666380013593433679",
                    "208726728939143904319120274308576416277",
                    "23686511696894709866346397045748315673",
                    "65333525003484184487365139394950227018",
                    "225926407366653861141125291681678342297",
                    "213008522495646628192596065558322107404",
                    "10036313730060407437412516506734674823",
                    "143471472001310313212702210723494825867",
                    "211982424676714602568669030251340215025",
                    "122022361506936548721657756885246230300",
                    "246830623291359353466295982805824052755",
                    "203661984909155791185733485882463201680",
                    "134182420467732203499480077612593495555",
                    "213368203140904731727178224429241062219",
                    "148225270485517718906329976952177729537",
                    "60867849361854279714501507875730397311",
                    "129499696879507256912651552967260195048"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-501447778-20af8025",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/dacded6e58912740e50c05264c21b609ab70f1c3",
            "target": {
                "file": "core/java/com/android/internal/widget/LocalImageResolver.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "138316194826753610241098808139202362662",
                "length": 1042
            },
            "id": "ASB-A-501447778-c15d709c",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/dacded6e58912740e50c05264c21b609ab70f1c3",
            "target": {
                "file": "core/java/com/android/internal/widget/LocalImageResolver.java",
                "function": "onHeaderDecoded"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "181779492444834365844778119335346448964",
                "length": 837
            },
            "id": "ASB-A-501447778-df8187bf",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/dacded6e58912740e50c05264c21b609ab70f1c3",
            "target": {
                "file": "core/java/com/android/internal/widget/LocalImageResolver.java",
                "function": "resolveImage"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-501447778.json"