CVE-2026-0049

MediumCVSS 6.2/10Last modified Jul 24, 2026

Description

In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 6.2/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published
Apr 6, 2026
Last modified
Jul 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-00503.3In handleBondStateChanged of AdapterService.java, there is a possible sensitive information disclosure due to a permissions bypass. This couCVE-2026-00516.5In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a system crash due to improper input validation. This CVE-2026-00526.5In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a crash due to an integer overflow. This could lead toCVE-2026-00543.3In isCallerAllowed of WalletContextualLocationsService.kt, there is a possible way to get wallet information due to a missing permission cheCVE-2026-00556.2In createSessionInternal of PackageInstallerService.java, there is a possible to update a Device Policy Controller (DPC) into an invalid dirCVE-2026-00563.3In setTo of ResourceTypes.cpp, there is a possible read out of bounds due to an incorrect bounds check. This could lead to local informationCVE-2026-00573.3In Contacts Provider, there is a possible way to access an incoming call's phone number and associated metadata due to a missing permission CVE-2026-00598.0In multiple functions of sdp_discovery.cc, there is a possible way to achieve code execution due to a heap buffer overflow. This could lead CVE-2026-00605.5In updateState of GraphicsDriverEnableAngleAsSystemDriverController.java, there is a possible persistent dos issue due to an unusual root caCVE-2026-00615.9In multiple functions of WindowState.java, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay aCVE-2026-00637.8In setAllowedCarriers of PhoneInterfaceManager.java, there is a possible way to disable carrier restrictions due to a logic error in the codCVE-2026-00645.5In multiple places, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service
CVE-2026-0049: Medium severity, CVSS 6.2 | Vulnix