CVE-2026-0014

MediumCVSS 6.2/10Last modified Sep 27, 2026

Description

In isPackageNullOrSystem of AppOpsService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 6.2/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Mar 2, 2026
Last modified
Sep 27, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-00156.2In multiple locations of AppOpsService.java, there is a possible persistent denial of service due to improper input validation. This could lCVE-2026-00163.3In updateProvidersWhenServiceRemoved of CredentialManagerService.java, there is a possible way to override settings across users due to a peCVE-2026-00177.7In onChange of BiometricService.java, there is a possible way to enable fingerprint unlock due to a logic error in the code. This could leadCVE-2026-00185.5In multiple functions of AccessibilityManagerService.java, there is a possible persistent denial of service due to improper input validationCVE-2026-00197.8In SettingsLib, there is a possible way to disable system components due to a logic error in the code. This could lead to local escalation oCVE-2026-00208.4In parsePermissionGroup of ParsedPermissionUtils.java, there is a possible way to bypass a consent dialog to obtain permissions due to a perCVE-2026-00218.4In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible cross-user permission bypass due to a confused deputy. ThisCVE-2026-00237.8In createSessionInternal of PackageInstallerService.java, there is a possible way for an app to update its ownership due to a missing permisCVE-2026-00244.0In isRedactionNeededForOpenViaContentResolver of MediaProvider.java, there is a possible way to reveal the location of media due to a missinCVE-2026-00258.4In hasImage of Notification.java, there is a possible way to reveal information across users due to a permissions bypass. This could lead toCVE-2026-00267.8In removePermission of PermissionManagerServiceImpl.java, there is a possible way to override any system permission due to a logic error inCVE-2026-00276.7In smmu_detach_dev of arm-smmu-v3.c, there is a possible out of bounds write due to a use after free. This could lead to local escalation of
CVE-2026-0014: Medium severity, CVSS 6.2 | Vulnix