CVE-2025-26429: Android Framework DoS Vulnerability in AppOpsService
Summary
CVE-2025-26429: In collectOps of AppOpsService.java, there is a possible way to cause permanent DoS due to improper input validation. Affects platform/frameworks/base across 4 version ranges.
>= 13:0, < 13:2025-05-01
>= 14:0, < 14:2025-05-01
>= 15:0, < 15:2025-05-01
>= 15-next:0, < 15-next:2025-05-01
Fixed in 15-next:2025-05-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Framework is a set of libraries and tools that allow developers to create applications for the Android operating system. It provides essential services such as user interface management, data storage, and system-level operations. The AppOpsService is responsible for managing app operations and permissions. This vulnerability affects the input validation process within this service, potentially leading to a denial of service (DoS).
Vulnerability Detail
In the collectOps method of AppOpsService.java, there exists a flaw in input validation that can be exploited to cause a permanent denial of service. This vulnerability allows an attacker to disrupt the normal functioning of the application without requiring additional execution privileges or user interaction. The issue arises from improper handling of inputs, which can lead to resource exhaustion and system instability.
How To Fix
Minimum fixed version
15-next:2025-05-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing additional input validation checks in your application to mitigate the risk of exploitation until the official patch is applied. This can include sanitizing inputs and limiting the types of data that can be processed by the collectOps method.
Conclusion
The CVE-2025-26429 vulnerability in the Android Framework's AppOpsService poses a significant risk of denial of service due to improper input validation. It is crucial for developers to update their applications to the patched version to ensure security and stability. Utilizing tools like Vulert can help in monitoring and identifying such vulnerabilities in real-time.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2025-26429 is a vulnerability in the Android Framework's AppOpsService that can lead to a denial of service due to improper input validation.
Exploitation of this vulnerability can cause your application to become unresponsive or crash, affecting user experience and system stability.
No, user interaction is not needed for exploitation, making it a significant risk for applications using the affected service.
You should update your application to the patched version of the Android Framework as soon as possible to mitigate the risk.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground at Vulert Scanner without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
