{"id":"ASB-A-472269954","details":"In createSessionInternal of PackageInstallerService.java, there is a possible way to permanently DoS the device due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-472269954","CVE-2026-28584"],"modified":"2026-09-10T15:43:18.983809180Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["DoS"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/174693f1586b7216c6f74a59c5a6c55e92acf1ff","target":{"file":"services/core/java/com/android/server/pm/PackageInstallerService.java"},"deprecated":false,"digest":{"line_hashes":["277827426775417050919952495055004549277","66268719618098379100660581316538426195","276576523798533265143373121852099052156","79716321625944541792730027652862945528","32843246800274118500279878416669081662","238625897045588819735687576536888286659","315517761902771516422882097428876370471","304944200626218992873944944094875652464"],"threshold":0.9},"id":"ASB-A-472269954-8982880e"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/174693f1586b7216c6f74a59c5a6c55e92acf1ff","target":{"file":"services/core/java/com/android/server/pm/PackageInstallerService.java","function":"createSessionInternal"},"deprecated":false,"digest":{"function_hash":"229381349720124623635292353533886373601","length":12410},"id":"ASB-A-472269954-bfa73af7","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/174693f1586b7216c6f74a59c5a6c55e92acf1ff"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-472269954.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["DoS"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a8e2a2350ce9851c9e5b1a68bdbbe913a4c6c36b","target":{"function":"createSessionInternal","file":"services/core/java/com/android/server/pm/PackageInstallerService.java"},"deprecated":false,"digest":{"function_hash":"338895600956412432101087457862411487182","length":12812},"id":"ASB-A-472269954-1ffa91c1","signature_type":"Function"},{"id":"ASB-A-472269954-c1be75ef","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a8e2a2350ce9851c9e5b1a68bdbbe913a4c6c36b","target":{"file":"services/core/java/com/android/server/pm/PackageInstallerService.java"},"deprecated":false,"digest":{"line_hashes":["277827426775417050919952495055004549277","66268719618098379100660581316538426195","276576523798533265143373121852099052156","79716321625944541792730027652862945528","32843246800274118500279878416669081662","238625897045588819735687576536888286659","315517761902771516422882097428876370471","304944200626218992873944944094875652464"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/a8e2a2350ce9851c9e5b1a68bdbbe913a4c6c36b"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-472269954.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/e11e5ec5fa15c45c9d97fffd5de10a8f81873325"],"severity":"High","spl":"2026-09-01","types":["DoS"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e11e5ec5fa15c45c9d97fffd5de10a8f81873325","target":{"file":"services/core/java/com/android/server/pm/PackageInstallerService.java","function":"createSessionInternal"},"deprecated":false,"digest":{"length":12410,"function_hash":"229381349720124623635292353533886373601"},"id":"ASB-A-472269954-6105e59e","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["277827426775417050919952495055004549277","66268719618098379100660581316538426195","276576523798533265143373121852099052156","79716321625944541792730027652862945528","32843246800274118500279878416669081662","238625897045588819735687576536888286659","315517761902771516422882097428876370471","304944200626218992873944944094875652464"],"threshold":0.9},"id":"ASB-A-472269954-826bd70c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e11e5ec5fa15c45c9d97fffd5de10a8f81873325","target":{"file":"services/core/java/com/android/server/pm/PackageInstallerService.java"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-472269954.json"}}],"schema_version":"1.9.0"}