{"id":"ASB-A-468061774","details":"In getPreferredSize of LauncherProcessImageListener.kt, there is a possible denial of service  due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-468061774","CVE-2026-0074"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2026-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-06-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/4abc0b8da1e97accf0213fd228f663f0fc6176a4"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/apps/Launcher3/+/8c33391368b8d4c08e4f32d8503dc97d9eff4b90"}],"affected":[{"package":{"name":"platform/packages/apps/Launcher3","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-06-01"}]}],"versions":["17-next"],"ecosystem_specific":{"severity":"High","spl":"2026-06-01","types":["DoS"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Launcher3/+/960fc6f7799ca578630140d683e67dba66ed9c29","target":{"file":"quickstep/src/com/android/quickstep/QuickstepProcessInitializer.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["144320127946502020898029972119879843581","81801731993251538335240617118512068236","196055837491338027079176568183138463595","224054895736423311774497611128953692262","167754495749241830989695420591033847795","66186824375500077324330284876390087414","125256915226159534232568629113051791441","286859558274032027654953154673300756262","82227736339411065798492744889229963040","294597585316349930818426951473829296366"]},"id":"ASB-A-468061774-5b1c47e1","signature_type":"Line"},{"digest":{"length":1453,"function_hash":"205155498544218627957661075033580388099"},"id":"ASB-A-468061774-c2125d5f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Launcher3/+/960fc6f7799ca578630140d683e67dba66ed9c29","target":{"file":"quickstep/src/com/android/quickstep/QuickstepProcessInitializer.java","function":"init"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/apps/Launcher3/+/960fc6f7799ca578630140d683e67dba66ed9c29"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-468061774.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-06-01"}]}],"versions":["15"],"ecosystem_specific":{"spl":"2026-06-01","types":["DoS"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/03f29bdf0d3db5f80b163f129b837301f2ffef64","target":{"file":"graphics/java/android/graphics/ImageDecoder.java"},"deprecated":false,"digest":{"line_hashes":["95287985635101168792673524620028754008","36739540266561496902159385282977382293","330237364194859935783538406993312041214","101590087136789759937883469852039358288","199964331527907365333253813866292923846","210641554794895097296033083333127749163","43804929691286279708761532097503455874","297200025035864600144819106724602344060","276994850873513865967707212008120257803","184127064753255140094342306827069561729"],"threshold":0.9},"id":"ASB-A-468061774-708c3fe8"},{"target":{"file":"graphics/java/android/graphics/ImageDecoder.java","function":"callHeaderDecoded"},"deprecated":false,"digest":{"function_hash":"239802139326552298493988901013479995068","length":240},"id":"ASB-A-468061774-aec607fc","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/03f29bdf0d3db5f80b163f129b837301f2ffef64"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/03f29bdf0d3db5f80b163f129b837301f2ffef64"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-468061774.json"}},{"package":{"name":"platform/packages/apps/Launcher3","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-06-01"}]}],"versions":["15"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Launcher3/+/53f32d73c2db2afc477454a3292e0484940e116c"],"severity":"High","spl":"2026-06-01","types":["DoS"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/apps/Launcher3/+/53f32d73c2db2afc477454a3292e0484940e116c","target":{"file":"quickstep/src/com/android/quickstep/QuickstepProcessInitializer.java"},"deprecated":false,"digest":{"line_hashes":["201668927302055045625001077639601737806","306476202978525665472569645527598141874","171857122476654111891032866992453101016","148859408310892878272991646542324184442","178719819910320373834518999800501838773","160885194343617801789233224687443979257","285187438767649141719852975530410613896","112055518289903350131922700222478089614","86090737865319561177354661609175547304","175442958215814381064396008567172266652","90293770803917746553512186430702475060"],"threshold":0.9},"id":"ASB-A-468061774-14c3492f","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Launcher3/+/53f32d73c2db2afc477454a3292e0484940e116c","target":{"file":"quickstep/src/com/android/quickstep/QuickstepProcessInitializer.java","function":"init"},"deprecated":false,"digest":{"function_hash":"167877981001765977334783028710563511954","length":734},"id":"ASB-A-468061774-f4100d21","signature_type":"Function"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-468061774.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-06-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"High","spl":"2026-06-01","types":["DoS"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/406446fdedb2fb01f021eb8f93f29b7ccad9e6e8","target":{"function":"callHeaderDecoded","file":"graphics/java/android/graphics/ImageDecoder.java"},"deprecated":false,"digest":{"function_hash":"239802139326552298493988901013479995068","length":240},"id":"ASB-A-468061774-6c051a31","signature_type":"Function","signature_version":"v1"},{"digest":{"threshold":0.9,"line_hashes":["95287985635101168792673524620028754008","36739540266561496902159385282977382293","330237364194859935783538406993312041214","101590087136789759937883469852039358288","199964331527907365333253813866292923846","210641554794895097296033083333127749163","43804929691286279708761532097503455874","297200025035864600144819106724602344060","276994850873513865967707212008120257803","184127064753255140094342306827069561729"]},"id":"ASB-A-468061774-d9be3db5","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/406446fdedb2fb01f021eb8f93f29b7ccad9e6e8","target":{"file":"graphics/java/android/graphics/ImageDecoder.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/406446fdedb2fb01f021eb8f93f29b7ccad9e6e8"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-468061774.json"}},{"package":{"name":"platform/packages/apps/Launcher3","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-06-01"}]}],"versions":["16"],"ecosystem_specific":{"types":["DoS"],"vanir_signatures":[{"target":{"file":"quickstep/src/com/android/quickstep/QuickstepProcessInitializer.java"},"deprecated":false,"digest":{"line_hashes":["201668927302055045625001077639601737806","306476202978525665472569645527598141874","171857122476654111891032866992453101016","148859408310892878272991646542324184442","167754495749241830989695420591033847795","66186824375500077324330284876390087414","78557532268220217776078738249901139348","329155343429827198385606047397882974556","112055518289903350131922700222478089614","24314139747563551324439532593236934864","70688883267229851945992225555720283719","335736833056446112421243221378373988952"],"threshold":0.9},"id":"ASB-A-468061774-17dd4ba2","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Launcher3/+/dae1f5a64a7c8d6a96552a1e11f6e5860e853c42"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Launcher3/+/dae1f5a64a7c8d6a96552a1e11f6e5860e853c42","target":{"file":"quickstep/src/com/android/quickstep/QuickstepProcessInitializer.java","function":"init"},"deprecated":false,"digest":{"function_hash":"195109170668628290353986167941458204357","length":813},"id":"ASB-A-468061774-cec23d02","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/packages/apps/Launcher3/+/dae1f5a64a7c8d6a96552a1e11f6e5860e853c42"],"severity":"High","spl":"2026-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-468061774.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-06-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"types":["DoS"],"vanir_signatures":[{"target":{"file":"graphics/java/android/graphics/ImageDecoder.java","function":"callHeaderDecoded"},"deprecated":false,"digest":{"function_hash":"239802139326552298493988901013479995068","length":240},"id":"ASB-A-468061774-08b78fcf","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/9249a165bc33a352d47efa75cc30bb2586e6b628"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/9249a165bc33a352d47efa75cc30bb2586e6b628","target":{"file":"graphics/java/android/graphics/ImageDecoder.java"},"deprecated":false,"digest":{"line_hashes":["95287985635101168792673524620028754008","36739540266561496902159385282977382293","330237364194859935783538406993312041214","101590087136789759937883469852039358288","199964331527907365333253813866292923846","210641554794895097296033083333127749163","43804929691286279708761532097503455874","297200025035864600144819106724602344060","276994850873513865967707212008120257803","184127064753255140094342306827069561729"],"threshold":0.9},"id":"ASB-A-468061774-a7127e99"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/9249a165bc33a352d47efa75cc30bb2586e6b628"],"severity":"High","spl":"2026-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-468061774.json"}},{"package":{"name":"platform/packages/apps/Launcher3","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-06-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"types":["DoS"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["201668927302055045625001077639601737806","306476202978525665472569645527598141874","171857122476654111891032866992453101016","148859408310892878272991646542324184442","167754495749241830989695420591033847795","66186824375500077324330284876390087414","125256915226159534232568629113051791441","131122525266142321769776393970369844133","283774370355606177610848699090962984115","335736833056446112421243221378373988952"],"threshold":0.9},"id":"ASB-A-468061774-50174610","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Launcher3/+/1f48425e4df2c6fd15ffea007c5ff26b540df34b","target":{"file":"quickstep/src/com/android/quickstep/QuickstepProcessInitializer.java"}},{"digest":{"function_hash":"169239910044736987229280475677109701618","length":1416},"id":"ASB-A-468061774-f1deac49","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Launcher3/+/1f48425e4df2c6fd15ffea007c5ff26b540df34b","target":{"function":"init","file":"quickstep/src/com/android/quickstep/QuickstepProcessInitializer.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/apps/Launcher3/+/1f48425e4df2c6fd15ffea007c5ff26b540df34b"],"severity":"High","spl":"2026-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-468061774.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-06-01"}]}],"versions":["14"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6a73cabc64e2b76f2da0400e91a7014f7399abe7","target":{"file":"graphics/java/android/graphics/ImageDecoder.java","function":"callHeaderDecoded"},"deprecated":false,"digest":{"length":240,"function_hash":"239802139326552298493988901013479995068"},"id":"ASB-A-468061774-43421ea0","signature_type":"Function"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/6a73cabc64e2b76f2da0400e91a7014f7399abe7","target":{"file":"graphics/java/android/graphics/ImageDecoder.java"},"deprecated":false,"digest":{"line_hashes":["95287985635101168792673524620028754008","36739540266561496902159385282977382293","330237364194859935783538406993312041214","101590087136789759937883469852039358288","199964331527907365333253813866292923846","210641554794895097296033083333127749163","43804929691286279708761532097503455874","297200025035864600144819106724602344060","276994850873513865967707212008120257803","184127064753255140094342306827069561729"],"threshold":0.9},"id":"ASB-A-468061774-d9119bc9","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/6a73cabc64e2b76f2da0400e91a7014f7399abe7"],"severity":"High","spl":"2026-06-01","types":["DoS"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-468061774.json"}},{"package":{"name":"platform/packages/apps/Launcher3","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-06-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","spl":"2026-06-01","types":["DoS"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/apps/Launcher3/+/88640014b648993d0ce15fb82aebf2e19cec94b4","target":{"function":"init","file":"quickstep/src/com/android/quickstep/QuickstepProcessInitializer.java"},"deprecated":false,"digest":{"length":487,"function_hash":"223216862684718473203562759642698310710"},"id":"ASB-A-468061774-879d0eef","signature_type":"Function","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/packages/apps/Launcher3/+/88640014b648993d0ce15fb82aebf2e19cec94b4","target":{"file":"quickstep/src/com/android/quickstep/QuickstepProcessInitializer.java"},"deprecated":false,"digest":{"line_hashes":["87424205977686052923499539394911392905","320357912726748764221608847122907288815","171857122476654111891032866992453101016","148859408310892878272991646542324184442","178719819910320373834518999800501838773","160885194343617801789233224687443979257","335648080460906252881816848505872310487","326643307977834684445083594133921518082","318612643498289357127891266088567038998","132296374516688346668164250446363420372","109889417846165099228917049219658224879"],"threshold":0.9},"id":"ASB-A-468061774-db0d75cf","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/apps/Launcher3/+/88640014b648993d0ce15fb82aebf2e19cec94b4"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-468061774.json"}}],"schema_version":"1.9.0"}