CVE-2026-28666

CVE-2026-28666 is a flaw in LocalImageResolver.java in the Android platform's image-handling code, where a DNG (Digital Negative) image rendering check can be bypassed. The Android security team classifies the issue as a remote persistent denial of service, but notes it could also lead to remote escalation of privilege, requiring no additional execution privileges and no user interaction. An attacker could trigger the flaw by getting a crafted DNG image processed by an affected device, degrading the device persistently or, per the bulletin, gaining elevated code execution. The flaw affects the Android platform component (assigned by security@android.com), so any Android device shipping the vulnerable image-resolution code is potentially exposed, pending OEM patches. There is currently no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.2% probability of exploitation in the next 30 days.

What to do: Apply the September 2026 Android security update (or later) as delivered by your device OEM or carrier, and confirm the fix by checking the device's Android security patch level. Until patched, treat DNG images from untrusted sources (messaging, email, web, cloud sync) with caution, and prioritize updating devices whose apps or workflows automatically process remote images. Since no exploit is public, routine patch cadence is reasonable for most fleets, with faster action for exposed, image-handling-heavy deployments.