CVE-2026-0056: Android Framework Base ResourceTypes.cpp Out of Bounds Read Vulnerability
Summary
CVE-2026-0056: In setTo of ResourceTypes.cpp, there is a possible read out of bounds due to an incorrect bounds check. Affects platform/frameworks/base across 5 version ranges.
>= 14:0, < 14:2026-06-01
>= 15:0, < 15:2026-06-01
>= 16:0, < 16:2026-06-01
>= 16-qpr2:0, < 16-qpr2:2026-06-01
>= 17-next:0, < 17-next:2026-06-01
Fixed in 17-next:2026-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Framework Base is a core component of the Android operating system, providing essential services and APIs for application development. It includes libraries and tools that developers use to create Android applications. This framework is crucial for resource management, including handling strings, layouts, and other resources. The vulnerability in question arises from an improper bounds check in the ResourceTypes.cpp file, which can lead to potential information disclosure.
Vulnerability Detail
In the setTo function of ResourceTypes.cpp, there is a flaw that allows for a possible read out of bounds due to an incorrect bounds check. This vulnerability can lead to local information disclosure without requiring additional execution privileges. The issue is triggered when the function processes resource strings, potentially exposing sensitive data stored in memory. User interaction is not necessary for exploitation, making this vulnerability particularly concerning.
How To Fix
Minimum fixed version
17-next:2026-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can implement input validation to ensure that resource strings are checked for proper bounds before being processed. This can help mitigate the risk of exploitation until the package is updated. Example code for input validation:
if (index >= 0 && index < resourceCount) {
// Safe to access the resource
}
else {
// Handle the error
}
Conclusion
The CVE-2026-0056 vulnerability in the Android Framework Base poses a significant risk due to its potential for local information disclosure. Users are strongly advised to update to the patched versions to secure their applications. Implementing input validation can serve as a temporary measure until the update is applied.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2026-0056 is a vulnerability in the Android Framework Base that allows for a potential out-of-bounds read, leading to local information disclosure.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary risk is local information disclosure, which could expose sensitive data to unauthorized users or processes.
No, user interaction is not needed for exploitation, making it a more serious concern.
Implement input validation as a temporary workaround to mitigate the risk until you can update the package.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
