{"id":"ASB-A-480126173","details":"In verifySignature of ApkChecksums.java, there is a possible way to cause a crash due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-480126173","CVE-2026-0069"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2026-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-06-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/7250d76a8a2d501af62081d88545c301d43106a4"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-06-01"}]}],"versions":["17-next"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7250d76a8a2d501af62081d88545c301d43106a4","target":{"file":"services/core/java/com/android/server/pm/ApkChecksums.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["33719583308461518223754020535270015727","230197713427242552805643149409708817252","237470075802497416336778592721713274957","274432018475942673636475421385694099840","50915274334044576986353013794661238676","68821143183192514488726270427560616354","270606388550509064474211534521519986132"]},"id":"ASB-A-480126173-3185a562"},{"target":{"file":"services/core/java/com/android/server/pm/ApkChecksums.java","function":"verifySignature"},"deprecated":false,"digest":{"function_hash":"196322122534322618596178905532956358144","length":849},"id":"ASB-A-480126173-47182498","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7250d76a8a2d501af62081d88545c301d43106a4"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7250d76a8a2d501af62081d88545c301d43106a4","target":{"function":"setChecksums","file":"services/core/java/com/android/server/pm/PackageInstallerSession.java"},"deprecated":false,"digest":{"function_hash":"152182908152038540052740678617275140030","length":1360},"id":"ASB-A-480126173-60e6c587","signature_type":"Function"},{"id":"ASB-A-480126173-6c970f0b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7250d76a8a2d501af62081d88545c301d43106a4","target":{"file":"services/core/java/com/android/server/pm/PackageInstallerSession.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["104157778623520416363664849116757157695","118253064761702962559805533758226833513","63898760132293395043063847565669460116","67679665752301720627004252341406100394"]}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/7250d76a8a2d501af62081d88545c301d43106a4"],"severity":"High","spl":"2026-06-01","types":["DoS"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-480126173.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-06-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","spl":"2026-06-01","types":["DoS"],"vanir_signatures":[{"id":"ASB-A-480126173-040a9c90","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a3ca193de2c8b789b59c9bfb7af529b9472da538","target":{"file":"services/core/java/com/android/server/pm/ApkChecksums.java","function":"verifySignature"},"deprecated":false,"digest":{"length":849,"function_hash":"196322122534322618596178905532956358144"}},{"target":{"file":"services/core/java/com/android/server/pm/ApkChecksums.java"},"deprecated":false,"digest":{"line_hashes":["33719583308461518223754020535270015727","230197713427242552805643149409708817252","237470075802497416336778592721713274957","274432018475942673636475421385694099840","50915274334044576986353013794661238676","68821143183192514488726270427560616354","270606388550509064474211534521519986132"],"threshold":0.9},"id":"ASB-A-480126173-91e5bf0a","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a3ca193de2c8b789b59c9bfb7af529b9472da538"},{"deprecated":false,"digest":{"function_hash":"154821382528633676636787911625232661444","length":1167},"id":"ASB-A-480126173-9230989e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a3ca193de2c8b789b59c9bfb7af529b9472da538","target":{"file":"services/core/java/com/android/server/pm/PackageInstallerSession.java","function":"setChecksums"}},{"id":"ASB-A-480126173-cbc5b335","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a3ca193de2c8b789b59c9bfb7af529b9472da538","target":{"file":"services/core/java/com/android/server/pm/PackageInstallerSession.java"},"deprecated":false,"digest":{"line_hashes":["104157778623520416363664849116757157695","118253064761702962559805533758226833513","63898760132293395043063847565669460116","331134040222295411895490707152638890070"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/a3ca193de2c8b789b59c9bfb7af529b9472da538"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-480126173.json"}}],"schema_version":"1.9.0"}