CVE-2026-0039: Critical Denial of Service Vulnerability in platform/external/dng_sdk
Summary
CVE-2026-0039: In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to an integer overflow. Affects platform/external/dng_sdk across 5 version ranges.
>= 14:0, < 14:2026-06-01
>= 15:0, < 15:2026-06-01
>= 16:0, < 16:2026-06-01
>= 16-qpr2:0, < 16-qpr2:2026-06-01
>= 17-next:0, < 17-next:2026-06-01
Fixed in 17-next:2026-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The platform/external/dng_sdk is an Android package that provides developers with tools for handling digital negative (DNG) image formats. It is widely used in applications that require high-quality image processing. However, this package has been found to contain a critical vulnerability that can lead to persistent denial of service, affecting the availability of applications that rely on it.
Vulnerability Detail
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to an integer overflow. This vulnerability allows an attacker to exploit the system remotely, leading to a denial of service without requiring additional execution privileges or user interaction. The critical nature of this vulnerability means that it can severely impact the functionality of applications using the affected package.
How To Fix
Minimum fixed version
17-next:2026-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is highly recommended to apply the patches as soon as possible to mitigate the risk of exploitation.
Conclusion
The CVE-2026-0039 vulnerability in the platform/external/dng_sdk package poses a significant risk of denial of service. It is essential for developers to update their packages to the patched versions to ensure the security and availability of their applications.
See every vulnerability recorded for platform/external/dng_sdk →
FAQ
CVE-2026-0039 is a critical vulnerability in the platform/external/dng_sdk package that can lead to persistent denial of service due to an integer overflow.
The vulnerability can be exploited remotely without requiring additional execution privileges or user interaction, potentially leading to a denial of service.
Versions 14, 15, 16, 16-qpr2, and 17-next of the platform/external/dng_sdk package are affected by this vulnerability.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities. Check your application against this vulnerability using the Vulert playground at Vulert Scanner without any signup.
While there are no specific workarounds, it is crucial to prioritize updating the package to the patched version to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/external/dng_sdk.
