AI analysis
CVE-2026-28666 is a flaw in LocalImageResolver.java in the Android platform's image-handling code, where a DNG (Digital Negative) image rendering check can be bypassed. The Android security team classifies the issue as a remote persistent denial of service, but notes it could also lead to remote escalation of privilege, requiring no additional execution privileges and no user interaction. An attacker could trigger the flaw by getting a crafted DNG image processed by an affected device, degrading the device persistently or, per the bulletin, gaining elevated code execution. The flaw affects the Android platform component (assigned by [email protected]), so any Android device shipping the vulnerable image-resolution code is potentially exposed, pending OEM patches. There is currently no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.2% probability of exploitation in the next 30 days.
What to do: Apply the September 2026 Android security update (or later) as delivered by your device OEM or carrier, and confirm the fix by checking the device's Android security patch level. Until patched, treat DNG images from untrusted sources (messaging, email, web, cloud sync) with caution, and prioritize updating devices whose apps or workflows automatically process remote images. Since no exploit is public, routine patch cadence is reasonable for most fleets, with faster action for exposed, image-handling-heavy deployments.
Affected
| Google / Android (AOSP) Android platform image handling component (LocalImageResolver.java, DNG rendering) | — |
Estimated exposure
mass≈3 billion+ Android devices potentially affected (global Android active install base) — Google publicly states Android runs on over 3 billion active devices, and the vulnerable code is in the platform image-resolution stack shipped across the ecosystem, so the upper bound of exposure is the Android install base, though only…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
In multiple functions of LocalImageResolver.java, there is a possible Remote Persistent Denial of Service due to a DNG image rendering check bypass. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.