{"id":"ASB-A-480126173", "published":"2026-06-01T00:00:00Z", "modified":"2026-06-12T15:08:17.296522730Z", "aliases":["CVE-2026-0069", "A-480126173"], "details":"In verifySignature of ApkChecksums.java, there is a possible way to cause a crash due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-06-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/7250d76a8a2d501af62081d88545c301d43106a4"], "severity":"High", "spl":"2026-06-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["33719583308461518223754020535270015727", "230197713427242552805643149409708817252", "237470075802497416336778592721713274957", "274432018475942673636475421385694099840", "50915274334044576986353013794661238676", "68821143183192514488726270427560616354", "270606388550509064474211534521519986132"], "threshold":0.9}, "id":"ASB-A-480126173-3185a562", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7250d76a8a2d501af62081d88545c301d43106a4", "target":{"file":"services/core/java/com/android/server/pm/ApkChecksums.java"}}, {"deprecated":false, "digest":{"function_hash":"196322122534322618596178905532956358144", "length":849}, "id":"ASB-A-480126173-47182498", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7250d76a8a2d501af62081d88545c301d43106a4", "target":{"file":"services/core/java/com/android/server/pm/ApkChecksums.java", "function":"verifySignature"}}, {"deprecated":false, "digest":{"function_hash":"152182908152038540052740678617275140030", "length":1360}, "id":"ASB-A-480126173-60e6c587", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7250d76a8a2d501af62081d88545c301d43106a4", "target":{"file":"services/core/java/com/android/server/pm/PackageInstallerSession.java", "function":"setChecksums"}}, {"deprecated":false, "digest":{"line_hashes":["104157778623520416363664849116757157695", "118253064761702962559805533758226833513", "63898760132293395043063847565669460116", "67679665752301720627004252341406100394"], "threshold":0.9}, "id":"ASB-A-480126173-6c970f0b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7250d76a8a2d501af62081d88545c301d43106a4", "target":{"file":"services/core/java/com/android/server/pm/PackageInstallerSession.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-06-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/a3ca193de2c8b789b59c9bfb7af529b9472da538"], "severity":"High", "spl":"2026-06-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"196322122534322618596178905532956358144", "length":849}, "id":"ASB-A-480126173-040a9c90", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a3ca193de2c8b789b59c9bfb7af529b9472da538", "target":{"file":"services/core/java/com/android/server/pm/ApkChecksums.java", "function":"verifySignature"}}, {"deprecated":false, "digest":{"line_hashes":["33719583308461518223754020535270015727", "230197713427242552805643149409708817252", "237470075802497416336778592721713274957", "274432018475942673636475421385694099840", "50915274334044576986353013794661238676", "68821143183192514488726270427560616354", "270606388550509064474211534521519986132"], "threshold":0.9}, "id":"ASB-A-480126173-91e5bf0a", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a3ca193de2c8b789b59c9bfb7af529b9472da538", "target":{"file":"services/core/java/com/android/server/pm/ApkChecksums.java"}}, {"deprecated":false, "digest":{"function_hash":"154821382528633676636787911625232661444", "length":1167}, "id":"ASB-A-480126173-9230989e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a3ca193de2c8b789b59c9bfb7af529b9472da538", "target":{"file":"services/core/java/com/android/server/pm/PackageInstallerSession.java", "function":"setChecksums"}}, {"deprecated":false, "digest":{"line_hashes":["104157778623520416363664849116757157695", "118253064761702962559805533758226833513", "63898760132293395043063847565669460116", "331134040222295411895490707152638890070"], "threshold":0.9}, "id":"ASB-A-480126173-cbc5b335", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a3ca193de2c8b789b59c9bfb7af529b9472da538", "target":{"file":"services/core/java/com/android/server/pm/PackageInstallerSession.java"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-06-01"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/frameworks/base/+/7250d76a8a2d501af62081d88545c301d43106a4"}]}