{"id":"ASB-A-501447778", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-10T15:43:18.983809180Z", "aliases":["CVE-2026-28666", "A-501447778"], "details":"In multiple functions of LocalImageResolver.java, there is a possible Remote Persistent Denial of Service due to a DNG image rendering check bypass. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/ea59bf7683410de0cb9fe57ff3c56bd5b39d7d7e", "https://android.googlesource.com/platform/frameworks/base/+/23799d7017ce40bed6d78dbd7595ff176b48bc8b"], "severity":"Critical", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"181779492444834365844778119335346448964", "length":837}, "id":"ASB-A-501447778-0ae84b3f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/ea59bf7683410de0cb9fe57ff3c56bd5b39d7d7e", "target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java", "function":"resolveImage"}}, {"deprecated":false, "digest":{"line_hashes":["259615616814576999863751968031017701462", "139909294273499117641436918074668974027", "339369719644469653010724501905577675975", "232071457955885568070084688025172819375", "225926407366653861141125291681678342297", "213008522495646628192596065558322107404", "10036313730060407437412516506734674823", "143471472001310313212702210723494825867", "211982424676714602568669030251340215025", "122022361506936548721657756885246230300", "246830623291359353466295982805824052755", "203661984909155791185733485882463201680", "134182420467732203499480077612593495555", "213368203140904731727178224429241062219", "148225270485517718906329976952177729537", "60867849361854279714501507875730397311", "129499696879507256912651552967260195048"], "threshold":0.9}, "id":"ASB-A-501447778-5462629b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/ea59bf7683410de0cb9fe57ff3c56bd5b39d7d7e", "target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java"}}, {"deprecated":false, "digest":{"function_hash":"84770000407260855850997646054532109453", "length":857}, "id":"ASB-A-501447778-574c2f71", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/23799d7017ce40bed6d78dbd7595ff176b48bc8b", "target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java", "function":"resolveImage"}}, {"deprecated":false, "digest":{"function_hash":"138316194826753610241098808139202362662", "length":1042}, "id":"ASB-A-501447778-a4801a92", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/ea59bf7683410de0cb9fe57ff3c56bd5b39d7d7e", "target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java", "function":"onHeaderDecoded"}}, {"deprecated":false, "digest":{"line_hashes":["142318132660448244596666380013593433679", "208726728939143904319120274308576416277", "23686511696894709866346397045748315673", "65333525003484184487365139394950227018", "225926407366653861141125291681678342297", "248973725219518955435762673770412228973", "240877631179777638639046522688214779546", "286781409708266251750161595945958659475", "221605527259751044431630177553344833207", "163030337801298817673220452038765106381", "88412822220008543630676450736551268724", "72545789367658983850124713650698414849"], "threshold":0.9}, "id":"ASB-A-501447778-b7e28355", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/23799d7017ce40bed6d78dbd7595ff176b48bc8b", "target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java"}}, {"deprecated":false, "digest":{"function_hash":"327375112703721220455359273499929644922", "length":369}, "id":"ASB-A-501447778-d49d66a9", "match_only_versions":["17-next"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/23799d7017ce40bed6d78dbd7595ff176b48bc8b", "target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java", "function":"onHeaderDecoded"}}, {"deprecated":false, "digest":{"function_hash":"8343066837056042004928488437492206078", "length":769}, "id":"ASB-A-501447778-e3cb9aa3", "match_only_versions":["17-next"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/23799d7017ce40bed6d78dbd7595ff176b48bc8b", "target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java", "function":"checkHeader"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-09-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/c3f25eaf01699da0d6cde92973030e73bd347958"], "severity":"Critical", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"138316194826753610241098808139202362662", "length":1042}, "id":"ASB-A-501447778-1af430bd", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/c3f25eaf01699da0d6cde92973030e73bd347958", "target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java", "function":"onHeaderDecoded"}}, {"deprecated":false, "digest":{"function_hash":"181779492444834365844778119335346448964", "length":837}, "id":"ASB-A-501447778-27db4f76", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/c3f25eaf01699da0d6cde92973030e73bd347958", "target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java", "function":"resolveImage"}}, {"deprecated":false, "digest":{"line_hashes":["259615616814576999863751968031017701462", "139909294273499117641436918074668974027", "339369719644469653010724501905577675975", "232071457955885568070084688025172819375", "142318132660448244596666380013593433679", "208726728939143904319120274308576416277", "23686511696894709866346397045748315673", "65333525003484184487365139394950227018", "225926407366653861141125291681678342297", "213008522495646628192596065558322107404", "10036313730060407437412516506734674823", "143471472001310313212702210723494825867", "211982424676714602568669030251340215025", "122022361506936548721657756885246230300", "246830623291359353466295982805824052755", "203661984909155791185733485882463201680", "134182420467732203499480077612593495555", "213368203140904731727178224429241062219", "148225270485517718906329976952177729537", "60867849361854279714501507875730397311", "129499696879507256912651552967260195048"], "threshold":0.9}, "id":"ASB-A-501447778-ddf11f02", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/c3f25eaf01699da0d6cde92973030e73bd347958", "target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/481a08c680c66c0a8334e1ac0e15a461306acce3"], "severity":"Critical", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"181779492444834365844778119335346448964", "length":837}, "id":"ASB-A-501447778-1218ab64", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/481a08c680c66c0a8334e1ac0e15a461306acce3", "target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java", "function":"resolveImage"}}, {"deprecated":false, "digest":{"line_hashes":["259615616814576999863751968031017701462", "139909294273499117641436918074668974027", "339369719644469653010724501905577675975", "232071457955885568070084688025172819375", "142318132660448244596666380013593433679", "208726728939143904319120274308576416277", "23686511696894709866346397045748315673", "65333525003484184487365139394950227018", "225926407366653861141125291681678342297", "213008522495646628192596065558322107404", "10036313730060407437412516506734674823", "143471472001310313212702210723494825867", "211982424676714602568669030251340215025", "122022361506936548721657756885246230300", "246830623291359353466295982805824052755", "203661984909155791185733485882463201680", "134182420467732203499480077612593495555", "213368203140904731727178224429241062219", "148225270485517718906329976952177729537", "60867849361854279714501507875730397311", "129499696879507256912651552967260195048"], "threshold":0.9}, "id":"ASB-A-501447778-bc568b43", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/481a08c680c66c0a8334e1ac0e15a461306acce3", "target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java"}}, {"deprecated":false, "digest":{"function_hash":"138316194826753610241098808139202362662", "length":1042}, "id":"ASB-A-501447778-c4594353", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/481a08c680c66c0a8334e1ac0e15a461306acce3", "target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java", "function":"onHeaderDecoded"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/eaaabc00153ce36cbb20e54cb9b6ed3037cdf3d2"], "severity":"Critical", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["259615616814576999863751968031017701462", "139909294273499117641436918074668974027", "339369719644469653010724501905577675975", "232071457955885568070084688025172819375", "142318132660448244596666380013593433679", "208726728939143904319120274308576416277", "23686511696894709866346397045748315673", "65333525003484184487365139394950227018", "225926407366653861141125291681678342297", "213008522495646628192596065558322107404", "10036313730060407437412516506734674823", "143471472001310313212702210723494825867", "211982424676714602568669030251340215025", "122022361506936548721657756885246230300", "246830623291359353466295982805824052755", "203661984909155791185733485882463201680", "134182420467732203499480077612593495555", "213368203140904731727178224429241062219", "148225270485517718906329976952177729537", "60867849361854279714501507875730397311", "129499696879507256912651552967260195048"], "threshold":0.9}, "id":"ASB-A-501447778-5c9fcbcc", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/eaaabc00153ce36cbb20e54cb9b6ed3037cdf3d2", "target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java"}}, {"deprecated":false, "digest":{"function_hash":"138316194826753610241098808139202362662", "length":1042}, "id":"ASB-A-501447778-6585bff5", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/eaaabc00153ce36cbb20e54cb9b6ed3037cdf3d2", "target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java", "function":"onHeaderDecoded"}}, {"deprecated":false, "digest":{"function_hash":"181779492444834365844778119335346448964", "length":837}, "id":"ASB-A-501447778-7f19edf8", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/eaaabc00153ce36cbb20e54cb9b6ed3037cdf3d2", "target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java", "function":"resolveImage"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/8653c76b7af1b66bcf98dfb277b5cfa17ea72008"], "severity":"Critical", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"138316194826753610241098808139202362662", "length":1042}, "id":"ASB-A-501447778-aa98025e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/8653c76b7af1b66bcf98dfb277b5cfa17ea72008", "target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java", "function":"onHeaderDecoded"}}, {"deprecated":false, "digest":{"function_hash":"181779492444834365844778119335346448964", "length":837}, "id":"ASB-A-501447778-b817120f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/8653c76b7af1b66bcf98dfb277b5cfa17ea72008", "target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java", "function":"resolveImage"}}, {"deprecated":false, "digest":{"line_hashes":["259615616814576999863751968031017701462", "139909294273499117641436918074668974027", "339369719644469653010724501905577675975", "232071457955885568070084688025172819375", "142318132660448244596666380013593433679", "208726728939143904319120274308576416277", "23686511696894709866346397045748315673", "65333525003484184487365139394950227018", "225926407366653861141125291681678342297", "213008522495646628192596065558322107404", "10036313730060407437412516506734674823", "143471472001310313212702210723494825867", "211982424676714602568669030251340215025", "122022361506936548721657756885246230300", "246830623291359353466295982805824052755", "203661984909155791185733485882463201680", "134182420467732203499480077612593495555", "213368203140904731727178224429241062219", "148225270485517718906329976952177729537", "60867849361854279714501507875730397311", "129499696879507256912651552967260195048"], "threshold":0.9}, "id":"ASB-A-501447778-b885bb7f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/8653c76b7af1b66bcf98dfb277b5cfa17ea72008", "target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-09-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/dacded6e58912740e50c05264c21b609ab70f1c3"], "severity":"Critical", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["259615616814576999863751968031017701462", "139909294273499117641436918074668974027", "339369719644469653010724501905577675975", "232071457955885568070084688025172819375", "142318132660448244596666380013593433679", "208726728939143904319120274308576416277", "23686511696894709866346397045748315673", "65333525003484184487365139394950227018", "225926407366653861141125291681678342297", "213008522495646628192596065558322107404", "10036313730060407437412516506734674823", "143471472001310313212702210723494825867", "211982424676714602568669030251340215025", "122022361506936548721657756885246230300", "246830623291359353466295982805824052755", "203661984909155791185733485882463201680", "134182420467732203499480077612593495555", "213368203140904731727178224429241062219", "148225270485517718906329976952177729537", "60867849361854279714501507875730397311", "129499696879507256912651552967260195048"], "threshold":0.9}, "id":"ASB-A-501447778-20af8025", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/dacded6e58912740e50c05264c21b609ab70f1c3", "target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java"}}, {"deprecated":false, "digest":{"function_hash":"138316194826753610241098808139202362662", "length":1042}, "id":"ASB-A-501447778-c15d709c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/dacded6e58912740e50c05264c21b609ab70f1c3", "target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java", "function":"onHeaderDecoded"}}, {"deprecated":false, "digest":{"function_hash":"181779492444834365844778119335346448964", "length":837}, "id":"ASB-A-501447778-df8187bf", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/dacded6e58912740e50c05264c21b609ab70f1c3", "target":{"file":"core/java/com/android/internal/widget/LocalImageResolver.java", "function":"resolveImage"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}