CVE-2026-28584 in Android

Sumário

de MITRE • 08/09/2026

In createSessionInternal of PackageInstallerService.java, there is a possible way to permanently DoS the device due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

• Responsável: Google Android
• Reservar: 02/03/2026
• Divulgação: 08/09/2026
• Moderação: aceite
• Entrada: VDB-400214
• CPE: pronto
• CWE: CWE-841 (confirmado)
• CVSS: 7.5 (VulDB)
• EPSS: 0.00000
• KEV: não
• Atividades: muito baixo
• Sector: Finance, Insurance, ...

Fontes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-28584
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-28584
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-28584/