CVE-2026-0056

LowCVSS 3.3/10Last modified Jul 22, 2026

Description

In setTo of ResourceTypes.cpp, there is a possible read out of bounds due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-120

Affected software

No affected versions have been published.

Timeline

Published
Jun 1, 2026
Last modified
Jul 22, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-00573.3In Contacts Provider, there is a possible way to access an incoming call's phone number and associated metadata due to a missing permission CVE-2026-00598.0In multiple functions of sdp_discovery.cc, there is a possible way to achieve code execution due to a heap buffer overflow. This could lead CVE-2026-00605.5In updateState of GraphicsDriverEnableAngleAsSystemDriverController.java, there is a possible persistent dos issue due to an unusual root caCVE-2026-00615.9In multiple functions of WindowState.java, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay aCVE-2026-00637.8In setAllowedCarriers of PhoneInterfaceManager.java, there is a possible way to disable carrier restrictions due to a logic error in the codCVE-2026-00645.5In multiple places, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service CVE-2026-00657.8In areBackgroundActivityStartsAllowed of BackgroundLaunchProcessController.java, there is a possible unintended way to launch activities in CVE-2026-00675.5In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a permanent denial of service due to a logic error in CVE-2026-00687.8In createSessionInternal of PackageInstallerService.java, there is a possible method to remove a DPC app from a managed device without DO coCVE-2026-00695.5In verifySignature of ApkChecksums.java, there is a possible way to cause a crash due to resource exhaustion. This could lead to local deniaCVE-2026-00705.5In multiple functions of DevicePolicyManagerService.java, there is a possible way to hide a system critical package due to improper input vaCVE-2026-00717.8In SettingsLib, there is a possible missing permission check due to a logic error in the code. This could lead to local escalation of privil
CVE-2026-0056: Low severity, CVSS 3.3 | Vulnix