CVE-2026-0051: Critical Denial of Service Vulnerability in platform/external/dng_sdk
Summary
CVE-2026-0051: In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a system crash due to improper input validation. Affects platform/external/dng_sdk across 5 version ranges.
>= 14:0, < 14:2026-06-01
>= 15:0, < 15:2026-06-01
>= 16:0, < 16:2026-06-01
>= 16-qpr2:0, < 16-qpr2:2026-06-01
>= 17-next:0, < 17-next:2026-06-01
Fixed in 17-next:2026-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The platform/external/dng_sdk is an essential component of the Android ecosystem, providing developers with tools for handling digital negative images. It is widely used in applications that require image processing capabilities. However, this package has been identified to have a critical vulnerability that could lead to system crashes and denial of service.
Vulnerability Detail
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a system crash due to improper input validation. This vulnerability allows an attacker to exploit the system remotely, leading to a denial of service without requiring additional execution privileges. User interaction is not needed for exploitation, making it particularly dangerous.
How To Fix
Minimum fixed version
17-next:2026-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is highly recommended to apply the patch as soon as possible to mitigate the risk.
Conclusion
The CVE-2026-0051 vulnerability in the platform/external/dng_sdk package poses a significant risk of denial of service due to improper input validation. It is crucial for developers to update their packages to the patched versions to mitigate this risk. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for platform/external/dng_sdk →
FAQ
CVE-2026-0051 is a critical vulnerability in the platform/external/dng_sdk package that can lead to a denial of service due to improper input validation.
The vulnerability can be exploited remotely without user interaction, potentially causing a system crash.
The main consequence is a denial of service, which can disrupt the functionality of applications relying on the dng_sdk package.
Yes, patches are available for various versions of the platform/external/dng_sdk package. Users should update to the latest fixed versions.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/external/dng_sdk.
