CVE-2026-0043: Critical Integer Overflow Vulnerability in Android DNG SDK
Summary
CVE-2026-0043: In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to an integer overflow. Affects platform/external/dng_sdk across 5 version ranges.
>= 14:0, < 14:2026-06-01
>= 15:0, < 15:2026-06-01
>= 16:0, < 16:2026-06-01
>= 16-qpr2:0, < 16-qpr2:2026-06-01
>= 17-next:0, < 17-next:2026-06-01
Fixed in 17-next:2026-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The DNG SDK (Digital Negative SDK) is an external library used in Android development for handling raw image formats. It provides developers with tools to process and manipulate digital images efficiently. However, this SDK has been found to contain a critical vulnerability that can lead to denial of service and potential privilege escalation.
Vulnerability Detail
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to an integer overflow. This vulnerability allows an attacker to exploit the system without requiring additional execution privileges or user interaction, potentially leading to local escalation of privileges.
How To Fix
Minimum fixed version
17-next:2026-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the patched version of the DNG SDK as soon as possible.
Conclusion
The CVE-2026-0043 vulnerability in the Android DNG SDK poses a significant risk due to its potential for denial of service and privilege escalation. It is essential for developers to update to the patched versions to ensure the security of their applications.
See every vulnerability recorded for platform/external/dng_sdk →
FAQ
CVE-2026-0043 is a critical vulnerability in the Android DNG SDK that can lead to denial of service and local privilege escalation due to an integer overflow.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to persistent denial of service and local escalation of privileges, potentially compromising the security of the application.
No, user interaction is not needed for exploitation, making it a critical security concern.
While there are no specific workarounds available, it is crucial to prioritize updating the SDK to mitigate the risk associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/external/dng_sdk.
