CVE-2026-0049
Summary
| CVE | CVE-2026-0049 |
|---|---|
| State | PUBLISHED |
| Assigner | google_android |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-04-06 19:16:26 UTC |
| Updated | 2026-04-10 18:54:40 UTC |
| Description | In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. |
Risk And Classification
Primary CVSS: v3.1 6.2 MEDIUM from ADP
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.000070000 probability, percentile 0.005830000 (date 2026-04-15)
Problem Types: CWE-400 | Denial of service | CWE-400 CWE-400 Uncontrolled Resource Consumption
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | ADP | DECLARED | 6.2 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary | 6.2 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
NoneIntegrity
NoneAvailability
HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Android | 14.0 | All | All | All | |
| Operating System | Android | 15.0 | All | All | All | |
| Operating System | Android | 16.0 | - | All | All | |
| Operating System | Android | 16.0 | qpr2_beta_1 | All | All | |
| Operating System | Android | 16.0 | qpr2_beta_2 | All | All | |
| Operating System | Android | 16.0 | qpr2_beta_3 | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| source.android.com/docs/security/bulletin/2026/2026-04-01 | [email protected] | source.android.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Cxxsheng (曹圣) and Yanjie Zhao (赵彦杰) of Huazhong University of Science and Technology (华中科技大学) and Canyie(石松洲) of LSPosed Team. (en)
There are currently no legacy QID mappings associated with this CVE.