Executive brief
A vulnerability in the Android system's package installation service could allow a malicious application to exhaust the device's memory. This results in a denial-of-service condition where the device becomes unresponsive or reboots. The attack can be carried out by a local app without requiring any special permissions or user interaction.
Technical details
A logic error exists in the 'PackageInstaller.Session#transfer' method within 'frameworks/base/services/core/java/com/android/server/pm/PackageInstallerSession.java'. This flaw enables a memory exhaustion attack (CWE-400) that can be triggered locally. An attacker can exploit this to cause a denial of service (DoS) on the affected device. No additional execution privileges or user interactions are required for exploitation. While the CNA provided a CVSS 4.0 score of 10.0 (Critical) with a network attack vector, the technical description and Android's own severity rating of 'High' suggest a local denial-of-service impact. The issue is addressed in Android 17 with security patch level 2026-07-01.
Affected products
- Google Android 17
Timeline
- 2026-06-16: advisory: Android 17 Security Release Notes published
- 2026-06-17: disclosed: NVD publication date
- 2026-07-01: patched: Security patch level for Android 17 devices