Executive brief
Android's image processing framework contains a vulnerability in how it validates and renders DNG (Digital Negative) image files. An attacker can craft a malicious DNG file that bypasses security checks to gain elevated system privileges on an Android device. No user action or special permissions are required to exploit this vulnerability, making it a significant risk to device security and user data.
Technical details
The vulnerability exists in multiple functions of LocalImageResolver.java and involves a DNG image rendering check bypass in the Android Framework's System component. The weakness allows an attacker to craft specially-crafted DNG files that circumvent validation logic, leading to remote escalation of privilege. The attack requires no additional execution privileges and no user interaction. The vulnerability is classified as a Framework-level issue (EoP - Escalation of Privilege) and has been patched in Android versions 14, 15, 16, 16-qpr2, and 17, with fixes released as part of the September 5, 2026 security patch level.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched