CVE-2026-28578: Android Frameworks Base Package Local Denial of Service Vulnerability
Summary
CVE-2026-28578: In multiple functions of DevicePolicyManagerService.java, there is a possible desync from persistence due to improper input validation. Affects platform/frameworks/base across 5 version ranges.
>= 14:0, < 14:2026-06-01
>= 15:0, < 15:2026-06-01
>= 16:0, < 16:2026-06-01
>= 16-qpr2:0, < 16-qpr2:2026-06-01
>= 17-next:0, < 17-next:2026-06-01
Fixed in 17-next:2026-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Frameworks Base package is a core component of the Android operating system, providing essential services and APIs for application development. It manages device policies and security features, enabling developers to create secure applications. However, it is susceptible to vulnerabilities that can affect its stability and security, such as the one described here.
Vulnerability Detail
In multiple functions of DevicePolicyManagerService.java, there is a possible desynchronization from persistence due to improper input validation. This vulnerability can lead to a local denial of service, where an attacker can disrupt the normal functioning of the device without requiring additional execution privileges. User interaction is not needed for exploitation, making it a significant security concern.
How To Fix
Minimum fixed version
17-next:2026-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as possible to mitigate the risk.
Conclusion
The CVE-2026-28578 vulnerability in the Android Frameworks Base package poses a significant risk of local denial of service due to improper input validation. It is essential to apply the available patches promptly to ensure the security and stability of applications relying on this package.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2026-28578 is a vulnerability in the Android Frameworks Base package that can lead to a local denial of service due to improper input validation.
This vulnerability can disrupt the normal functioning of devices running affected versions of the Android Frameworks Base package, potentially leading to service interruptions.
No, user interaction is not needed for exploitation, making it easier for attackers to exploit the vulnerability.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities in real-time.
While there are no specific workarounds, it is crucial to prioritize applying the patch as soon as possible to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
