CVE-2026-28575
Awaiting Analysis Awaiting Analysis - Queue

Memory Exhaustion in Android PackageInstaller

Publication date: 2026-06-17

Last updated on: 2026-06-17

Assigner: Android (associated with Google Inc. or Open Handset Alliance)

Description
In PackageInstaller.Session#transfer of frameworks/base/services/core/java/com/android/server/pm/PackageInstallerSession.java, there is a possible memory exhaustion attack due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-06-17
Last Modified
2026-06-17
Generated
2026-07-08
AI Q&A
2026-06-17
EPSS Evaluated
2026-07-06
NVD
CVE-2026-28575
EUVD
EUVD-2026-37566

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
android packageinstaller *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in the PackageInstaller.Session#transfer method within the Android PackageInstaller component. It is caused by a logic error that can lead to a memory exhaustion attack.

An attacker can exploit this flaw locally without needing any special privileges or user interaction, potentially causing the system to run out of memory.

This results in a denial of service condition on the affected device.

Impact Analysis

The primary impact of this vulnerability is a local denial of service (DoS) on the affected Android device.

Because the attack can be performed without any privileges or user interaction, it could be triggered by a local attacker or malicious app to disrupt normal device operation by exhausting memory resources.

No additional execution privileges are needed, so the attacker does not gain control beyond causing the device or service to become unresponsive.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-28575. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart