{"id":"ASB-A-501447778","details":"In multiple functions of LocalImageResolver.java, there is a possible Remote Persistent Denial of Service due to a DNG image rendering check bypass. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-501447778","CVE-2026-28666"],"modified":"2026-09-09T15:15:54.249544283Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"181779492444834365844778119335346448964","length":837},"id":"ASB-A-501447778-0ae84b3f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ea59bf7683410de0cb9fe57ff3c56bd5b39d7d7e","target":{"function":"resolveImage","file":"core/java/com/android/internal/widget/LocalImageResolver.java"}},{"id":"ASB-A-501447778-5462629b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ea59bf7683410de0cb9fe57ff3c56bd5b39d7d7e","target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["259615616814576999863751968031017701462","139909294273499117641436918074668974027","339369719644469653010724501905577675975","232071457955885568070084688025172819375","225926407366653861141125291681678342297","213008522495646628192596065558322107404","10036313730060407437412516506734674823","143471472001310313212702210723494825867","211982424676714602568669030251340215025","122022361506936548721657756885246230300","246830623291359353466295982805824052755","203661984909155791185733485882463201680","134182420467732203499480077612593495555","213368203140904731727178224429241062219","148225270485517718906329976952177729537","60867849361854279714501507875730397311","129499696879507256912651552967260195048"]}},{"id":"ASB-A-501447778-574c2f71","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/23799d7017ce40bed6d78dbd7595ff176b48bc8b","target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java","function":"resolveImage"},"deprecated":false,"digest":{"function_hash":"84770000407260855850997646054532109453","length":857}},{"target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java","function":"onHeaderDecoded"},"deprecated":false,"digest":{"function_hash":"138316194826753610241098808139202362662","length":1042},"id":"ASB-A-501447778-a4801a92","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ea59bf7683410de0cb9fe57ff3c56bd5b39d7d7e"},{"id":"ASB-A-501447778-b7e28355","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/23799d7017ce40bed6d78dbd7595ff176b48bc8b","target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["142318132660448244596666380013593433679","208726728939143904319120274308576416277","23686511696894709866346397045748315673","65333525003484184487365139394950227018","225926407366653861141125291681678342297","248973725219518955435762673770412228973","240877631179777638639046522688214779546","286781409708266251750161595945958659475","221605527259751044431630177553344833207","163030337801298817673220452038765106381","88412822220008543630676450736551268724","72545789367658983850124713650698414849"]}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/23799d7017ce40bed6d78dbd7595ff176b48bc8b","target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java","function":"onHeaderDecoded"},"deprecated":false,"digest":{"length":369,"function_hash":"327375112703721220455359273499929644922"},"id":"ASB-A-501447778-d49d66a9","match_only_versions":["17-next"],"signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"8343066837056042004928488437492206078","length":769},"id":"ASB-A-501447778-e3cb9aa3","match_only_versions":["17-next"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/23799d7017ce40bed6d78dbd7595ff176b48bc8b","target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java","function":"checkHeader"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/ea59bf7683410de0cb9fe57ff3c56bd5b39d7d7e","https://android.googlesource.com/platform/frameworks/base/+/23799d7017ce40bed6d78dbd7595ff176b48bc8b"],"severity":"Critical","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-501447778.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"digest":{"length":1042,"function_hash":"138316194826753610241098808139202362662"},"id":"ASB-A-501447778-1af430bd","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c3f25eaf01699da0d6cde92973030e73bd347958","target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java","function":"onHeaderDecoded"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c3f25eaf01699da0d6cde92973030e73bd347958","target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java","function":"resolveImage"},"deprecated":false,"digest":{"function_hash":"181779492444834365844778119335346448964","length":837},"id":"ASB-A-501447778-27db4f76"},{"target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java"},"deprecated":false,"digest":{"line_hashes":["259615616814576999863751968031017701462","139909294273499117641436918074668974027","339369719644469653010724501905577675975","232071457955885568070084688025172819375","142318132660448244596666380013593433679","208726728939143904319120274308576416277","23686511696894709866346397045748315673","65333525003484184487365139394950227018","225926407366653861141125291681678342297","213008522495646628192596065558322107404","10036313730060407437412516506734674823","143471472001310313212702210723494825867","211982424676714602568669030251340215025","122022361506936548721657756885246230300","246830623291359353466295982805824052755","203661984909155791185733485882463201680","134182420467732203499480077612593495555","213368203140904731727178224429241062219","148225270485517718906329976952177729537","60867849361854279714501507875730397311","129499696879507256912651552967260195048"],"threshold":0.9},"id":"ASB-A-501447778-ddf11f02","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c3f25eaf01699da0d6cde92973030e73bd347958"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/c3f25eaf01699da0d6cde92973030e73bd347958"],"severity":"Critical","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-501447778.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"target":{"function":"resolveImage","file":"core/java/com/android/internal/widget/LocalImageResolver.java"},"deprecated":false,"digest":{"function_hash":"181779492444834365844778119335346448964","length":837},"id":"ASB-A-501447778-1218ab64","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/481a08c680c66c0a8334e1ac0e15a461306acce3"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/481a08c680c66c0a8334e1ac0e15a461306acce3","target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java"},"deprecated":false,"digest":{"line_hashes":["259615616814576999863751968031017701462","139909294273499117641436918074668974027","339369719644469653010724501905577675975","232071457955885568070084688025172819375","142318132660448244596666380013593433679","208726728939143904319120274308576416277","23686511696894709866346397045748315673","65333525003484184487365139394950227018","225926407366653861141125291681678342297","213008522495646628192596065558322107404","10036313730060407437412516506734674823","143471472001310313212702210723494825867","211982424676714602568669030251340215025","122022361506936548721657756885246230300","246830623291359353466295982805824052755","203661984909155791185733485882463201680","134182420467732203499480077612593495555","213368203140904731727178224429241062219","148225270485517718906329976952177729537","60867849361854279714501507875730397311","129499696879507256912651552967260195048"],"threshold":0.9},"id":"ASB-A-501447778-bc568b43","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/481a08c680c66c0a8334e1ac0e15a461306acce3","target":{"function":"onHeaderDecoded","file":"core/java/com/android/internal/widget/LocalImageResolver.java"},"deprecated":false,"digest":{"function_hash":"138316194826753610241098808139202362662","length":1042},"id":"ASB-A-501447778-c4594353"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/481a08c680c66c0a8334e1ac0e15a461306acce3"],"severity":"Critical","spl":"2026-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-501447778.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"vanir_signatures":[{"target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java"},"deprecated":false,"digest":{"line_hashes":["259615616814576999863751968031017701462","139909294273499117641436918074668974027","339369719644469653010724501905577675975","232071457955885568070084688025172819375","142318132660448244596666380013593433679","208726728939143904319120274308576416277","23686511696894709866346397045748315673","65333525003484184487365139394950227018","225926407366653861141125291681678342297","213008522495646628192596065558322107404","10036313730060407437412516506734674823","143471472001310313212702210723494825867","211982424676714602568669030251340215025","122022361506936548721657756885246230300","246830623291359353466295982805824052755","203661984909155791185733485882463201680","134182420467732203499480077612593495555","213368203140904731727178224429241062219","148225270485517718906329976952177729537","60867849361854279714501507875730397311","129499696879507256912651552967260195048"],"threshold":0.9},"id":"ASB-A-501447778-5c9fcbcc","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/eaaabc00153ce36cbb20e54cb9b6ed3037cdf3d2"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/eaaabc00153ce36cbb20e54cb9b6ed3037cdf3d2","target":{"function":"onHeaderDecoded","file":"core/java/com/android/internal/widget/LocalImageResolver.java"},"deprecated":false,"digest":{"function_hash":"138316194826753610241098808139202362662","length":1042},"id":"ASB-A-501447778-6585bff5","signature_type":"Function"},{"target":{"function":"resolveImage","file":"core/java/com/android/internal/widget/LocalImageResolver.java"},"deprecated":false,"digest":{"function_hash":"181779492444834365844778119335346448964","length":837},"id":"ASB-A-501447778-7f19edf8","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/eaaabc00153ce36cbb20e54cb9b6ed3037cdf3d2"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/eaaabc00153ce36cbb20e54cb9b6ed3037cdf3d2"],"severity":"Critical","spl":"2026-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-501447778.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java","function":"onHeaderDecoded"},"deprecated":false,"digest":{"length":1042,"function_hash":"138316194826753610241098808139202362662"},"id":"ASB-A-501447778-aa98025e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8653c76b7af1b66bcf98dfb277b5cfa17ea72008"},{"id":"ASB-A-501447778-b817120f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8653c76b7af1b66bcf98dfb277b5cfa17ea72008","target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java","function":"resolveImage"},"deprecated":false,"digest":{"function_hash":"181779492444834365844778119335346448964","length":837}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/8653c76b7af1b66bcf98dfb277b5cfa17ea72008","target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java"},"deprecated":false,"digest":{"line_hashes":["259615616814576999863751968031017701462","139909294273499117641436918074668974027","339369719644469653010724501905577675975","232071457955885568070084688025172819375","142318132660448244596666380013593433679","208726728939143904319120274308576416277","23686511696894709866346397045748315673","65333525003484184487365139394950227018","225926407366653861141125291681678342297","213008522495646628192596065558322107404","10036313730060407437412516506734674823","143471472001310313212702210723494825867","211982424676714602568669030251340215025","122022361506936548721657756885246230300","246830623291359353466295982805824052755","203661984909155791185733485882463201680","134182420467732203499480077612593495555","213368203140904731727178224429241062219","148225270485517718906329976952177729537","60867849361854279714501507875730397311","129499696879507256912651552967260195048"],"threshold":0.9},"id":"ASB-A-501447778-b885bb7f","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/8653c76b7af1b66bcf98dfb277b5cfa17ea72008"],"severity":"Critical","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-501447778.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-09-01"}]}],"versions":["14"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/dacded6e58912740e50c05264c21b609ab70f1c3","target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["259615616814576999863751968031017701462","139909294273499117641436918074668974027","339369719644469653010724501905577675975","232071457955885568070084688025172819375","142318132660448244596666380013593433679","208726728939143904319120274308576416277","23686511696894709866346397045748315673","65333525003484184487365139394950227018","225926407366653861141125291681678342297","213008522495646628192596065558322107404","10036313730060407437412516506734674823","143471472001310313212702210723494825867","211982424676714602568669030251340215025","122022361506936548721657756885246230300","246830623291359353466295982805824052755","203661984909155791185733485882463201680","134182420467732203499480077612593495555","213368203140904731727178224429241062219","148225270485517718906329976952177729537","60867849361854279714501507875730397311","129499696879507256912651552967260195048"]},"id":"ASB-A-501447778-20af8025","signature_type":"Line"},{"digest":{"function_hash":"138316194826753610241098808139202362662","length":1042},"id":"ASB-A-501447778-c15d709c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/dacded6e58912740e50c05264c21b609ab70f1c3","target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java","function":"onHeaderDecoded"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/dacded6e58912740e50c05264c21b609ab70f1c3","target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java","function":"resolveImage"},"deprecated":false,"digest":{"function_hash":"181779492444834365844778119335346448964","length":837},"id":"ASB-A-501447778-df8187bf"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/dacded6e58912740e50c05264c21b609ab70f1c3"],"severity":"Critical","spl":"2026-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-501447778.json"}}],"schema_version":"1.9.0"}