{"id":"ASB-A-468061774", "published":"2026-06-01T00:00:00Z", "modified":"2026-06-17T15:23:34.405473849Z", "aliases":["CVE-2026-0074", "A-468061774"], "details":"In getPreferredSize of LauncherProcessImageListener.kt, there is a possible denial of service  due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/apps/Launcher3", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-06-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Launcher3/+/960fc6f7799ca578630140d683e67dba66ed9c29"], "severity":"High", "spl":"2026-06-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["144320127946502020898029972119879843581", "81801731993251538335240617118512068236", "196055837491338027079176568183138463595", "224054895736423311774497611128953692262", "167754495749241830989695420591033847795", "66186824375500077324330284876390087414", "125256915226159534232568629113051791441", "286859558274032027654953154673300756262", "82227736339411065798492744889229963040", "294597585316349930818426951473829296366"], "threshold":0.9}, "id":"ASB-A-468061774-5b1c47e1", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Launcher3/+/960fc6f7799ca578630140d683e67dba66ed9c29", "target":{"file":"quickstep/src/com/android/quickstep/QuickstepProcessInitializer.java"}}, {"deprecated":false, "digest":{"function_hash":"205155498544218627957661075033580388099", "length":1453}, "id":"ASB-A-468061774-c2125d5f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Launcher3/+/960fc6f7799ca578630140d683e67dba66ed9c29", "target":{"file":"quickstep/src/com/android/quickstep/QuickstepProcessInitializer.java", "function":"init"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-06-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/03f29bdf0d3db5f80b163f129b837301f2ffef64"], "severity":"High", "spl":"2026-06-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["95287985635101168792673524620028754008", "36739540266561496902159385282977382293", "330237364194859935783538406993312041214", "101590087136789759937883469852039358288", "199964331527907365333253813866292923846", "210641554794895097296033083333127749163", "43804929691286279708761532097503455874", "297200025035864600144819106724602344060", "276994850873513865967707212008120257803", "184127064753255140094342306827069561729"], "threshold":0.9}, "id":"ASB-A-468061774-708c3fe8", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/03f29bdf0d3db5f80b163f129b837301f2ffef64", "target":{"file":"graphics/java/android/graphics/ImageDecoder.java"}}, {"deprecated":false, "digest":{"function_hash":"239802139326552298493988901013479995068", "length":240}, "id":"ASB-A-468061774-aec607fc", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/03f29bdf0d3db5f80b163f129b837301f2ffef64", "target":{"file":"graphics/java/android/graphics/ImageDecoder.java", "function":"callHeaderDecoded"}}]}}, {"package":{"name":"platform/packages/apps/Launcher3", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-06-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Launcher3/+/53f32d73c2db2afc477454a3292e0484940e116c"], "severity":"High", "spl":"2026-06-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["201668927302055045625001077639601737806", "306476202978525665472569645527598141874", "171857122476654111891032866992453101016", "148859408310892878272991646542324184442", "178719819910320373834518999800501838773", "160885194343617801789233224687443979257", "285187438767649141719852975530410613896", "112055518289903350131922700222478089614", "86090737865319561177354661609175547304", "175442958215814381064396008567172266652", "90293770803917746553512186430702475060"], "threshold":0.9}, "id":"ASB-A-468061774-14c3492f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Launcher3/+/53f32d73c2db2afc477454a3292e0484940e116c", "target":{"file":"quickstep/src/com/android/quickstep/QuickstepProcessInitializer.java"}}, {"deprecated":false, "digest":{"function_hash":"167877981001765977334783028710563511954", "length":734}, "id":"ASB-A-468061774-f4100d21", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Launcher3/+/53f32d73c2db2afc477454a3292e0484940e116c", "target":{"file":"quickstep/src/com/android/quickstep/QuickstepProcessInitializer.java", "function":"init"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-06-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/406446fdedb2fb01f021eb8f93f29b7ccad9e6e8"], "severity":"High", "spl":"2026-06-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"239802139326552298493988901013479995068", "length":240}, "id":"ASB-A-468061774-6c051a31", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/406446fdedb2fb01f021eb8f93f29b7ccad9e6e8", "target":{"file":"graphics/java/android/graphics/ImageDecoder.java", "function":"callHeaderDecoded"}}, {"deprecated":false, "digest":{"line_hashes":["95287985635101168792673524620028754008", "36739540266561496902159385282977382293", "330237364194859935783538406993312041214", "101590087136789759937883469852039358288", "199964331527907365333253813866292923846", "210641554794895097296033083333127749163", "43804929691286279708761532097503455874", "297200025035864600144819106724602344060", "276994850873513865967707212008120257803", "184127064753255140094342306827069561729"], "threshold":0.9}, "id":"ASB-A-468061774-d9be3db5", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/406446fdedb2fb01f021eb8f93f29b7ccad9e6e8", "target":{"file":"graphics/java/android/graphics/ImageDecoder.java"}}]}}, {"package":{"name":"platform/packages/apps/Launcher3", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-06-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Launcher3/+/dae1f5a64a7c8d6a96552a1e11f6e5860e853c42"], "severity":"High", "spl":"2026-06-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["201668927302055045625001077639601737806", "306476202978525665472569645527598141874", "171857122476654111891032866992453101016", "148859408310892878272991646542324184442", "167754495749241830989695420591033847795", "66186824375500077324330284876390087414", "78557532268220217776078738249901139348", "329155343429827198385606047397882974556", "112055518289903350131922700222478089614", "24314139747563551324439532593236934864", "70688883267229851945992225555720283719", "335736833056446112421243221378373988952"], "threshold":0.9}, "id":"ASB-A-468061774-17dd4ba2", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Launcher3/+/dae1f5a64a7c8d6a96552a1e11f6e5860e853c42", "target":{"file":"quickstep/src/com/android/quickstep/QuickstepProcessInitializer.java"}}, {"deprecated":false, "digest":{"function_hash":"195109170668628290353986167941458204357", "length":813}, "id":"ASB-A-468061774-cec23d02", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Launcher3/+/dae1f5a64a7c8d6a96552a1e11f6e5860e853c42", "target":{"file":"quickstep/src/com/android/quickstep/QuickstepProcessInitializer.java", "function":"init"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-06-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/9249a165bc33a352d47efa75cc30bb2586e6b628"], "severity":"High", "spl":"2026-06-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"239802139326552298493988901013479995068", "length":240}, "id":"ASB-A-468061774-08b78fcf", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/9249a165bc33a352d47efa75cc30bb2586e6b628", "target":{"file":"graphics/java/android/graphics/ImageDecoder.java", "function":"callHeaderDecoded"}}, {"deprecated":false, "digest":{"line_hashes":["95287985635101168792673524620028754008", "36739540266561496902159385282977382293", "330237364194859935783538406993312041214", "101590087136789759937883469852039358288", "199964331527907365333253813866292923846", "210641554794895097296033083333127749163", "43804929691286279708761532097503455874", "297200025035864600144819106724602344060", "276994850873513865967707212008120257803", "184127064753255140094342306827069561729"], "threshold":0.9}, "id":"ASB-A-468061774-a7127e99", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/9249a165bc33a352d47efa75cc30bb2586e6b628", "target":{"file":"graphics/java/android/graphics/ImageDecoder.java"}}]}}, {"package":{"name":"platform/packages/apps/Launcher3", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-06-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Launcher3/+/1f48425e4df2c6fd15ffea007c5ff26b540df34b"], "severity":"High", "spl":"2026-06-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["201668927302055045625001077639601737806", "306476202978525665472569645527598141874", "171857122476654111891032866992453101016", "148859408310892878272991646542324184442", "167754495749241830989695420591033847795", "66186824375500077324330284876390087414", "125256915226159534232568629113051791441", "131122525266142321769776393970369844133", "283774370355606177610848699090962984115", "335736833056446112421243221378373988952"], "threshold":0.9}, "id":"ASB-A-468061774-50174610", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Launcher3/+/1f48425e4df2c6fd15ffea007c5ff26b540df34b", "target":{"file":"quickstep/src/com/android/quickstep/QuickstepProcessInitializer.java"}}, {"deprecated":false, "digest":{"function_hash":"169239910044736987229280475677109701618", "length":1416}, "id":"ASB-A-468061774-f1deac49", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Launcher3/+/1f48425e4df2c6fd15ffea007c5ff26b540df34b", "target":{"file":"quickstep/src/com/android/quickstep/QuickstepProcessInitializer.java", "function":"init"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-06-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/6a73cabc64e2b76f2da0400e91a7014f7399abe7"], "severity":"High", "spl":"2026-06-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"239802139326552298493988901013479995068", "length":240}, "id":"ASB-A-468061774-43421ea0", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/6a73cabc64e2b76f2da0400e91a7014f7399abe7", "target":{"file":"graphics/java/android/graphics/ImageDecoder.java", "function":"callHeaderDecoded"}}, {"deprecated":false, "digest":{"line_hashes":["95287985635101168792673524620028754008", "36739540266561496902159385282977382293", "330237364194859935783538406993312041214", "101590087136789759937883469852039358288", "199964331527907365333253813866292923846", "210641554794895097296033083333127749163", "43804929691286279708761532097503455874", "297200025035864600144819106724602344060", "276994850873513865967707212008120257803", "184127064753255140094342306827069561729"], "threshold":0.9}, "id":"ASB-A-468061774-d9119bc9", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/6a73cabc64e2b76f2da0400e91a7014f7399abe7", "target":{"file":"graphics/java/android/graphics/ImageDecoder.java"}}]}}, {"package":{"name":"platform/packages/apps/Launcher3", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-06-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Launcher3/+/88640014b648993d0ce15fb82aebf2e19cec94b4"], "severity":"High", "spl":"2026-06-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"223216862684718473203562759642698310710", "length":487}, "id":"ASB-A-468061774-879d0eef", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Launcher3/+/88640014b648993d0ce15fb82aebf2e19cec94b4", "target":{"file":"quickstep/src/com/android/quickstep/QuickstepProcessInitializer.java", "function":"init"}}, {"deprecated":false, "digest":{"line_hashes":["87424205977686052923499539394911392905", "320357912726748764221608847122907288815", "171857122476654111891032866992453101016", "148859408310892878272991646542324184442", "178719819910320373834518999800501838773", "160885194343617801789233224687443979257", "335648080460906252881816848505872310487", "326643307977834684445083594133921518082", "318612643498289357127891266088567038998", "132296374516688346668164250446363420372", "109889417846165099228917049219658224879"], "threshold":0.9}, "id":"ASB-A-468061774-db0d75cf", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Launcher3/+/88640014b648993d0ce15fb82aebf2e19cec94b4", "target":{"file":"quickstep/src/com/android/quickstep/QuickstepProcessInitializer.java"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-06-01"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/frameworks/base/+/4abc0b8da1e97accf0213fd228f663f0fc6176a4"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/packages/apps/Launcher3/+/8c33391368b8d4c08e4f32d8503dc97d9eff4b90"}]}