CVE-2026-28633

MediumCVSS 5.5/10Last modified Sep 15, 2026

Description

In initForUserNoTracing of VoiceInteractionManagerService.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published
Sep 8, 2026
Last modified
Sep 15, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-286347.8In handleUssdRequest of PhoneInterfaceManager.java, there is a possible way to send a USSD request without permission due to a logic error iCVE-2026-286367.8In setupLayout of PickActivity.java, there is a possible bypass of the "Install unknown apps" security restriction due to a confused deputy.CVE-2026-286383.3In multiple functions of XmpDataParser.java, there is a possible improper data sanitization due to a logic error in the code. This could leaCVE-2026-286397.8In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to a logic error in the code. This could lead to local esCVE-2026-28645.4A vulnerability has been found in feng_ha_ha/megagao ssm-erp and production_ssm up to 4288d53bd35757b27f2d070057aefb2c07bdd097. This affectsCVE-2026-286407.8In checkCallerIsCertInstallerOrSelfInProfile of CredentialStorageActivity.java, there is a possible permission bypass due to improper input CVE-2026-286417.8In shouldDisableUninstallButton of ApplicationActionButtonsPreferenceController.java, there is a possible permission bypass due to a logic eCVE-2026-286427.8In executeRequest of ActivityStarter.java, there is a possible background activity launch due to a logic error in the code. This could lead CVE-2026-286447.8In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible permission bypass due to a confused deputy. This could CVE-2026-286477.8In updateState of DeviceAdminAppsPreferenceController.java, there is a possible permission bypass due to a logic error in the code. This couCVE-2026-286487.8In Settings, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additiCVE-2026-28659.8A vulnerability was found in itsourcecode Agri-Trading Online Shopping System 1.0. This impacts an unknown function of the file admin/produc
CVE-2026-28633: Medium severity, CVSS 5.5 | Vulnix