EUVD-2026-37566

🗓️ 17 Jun 2026 07:02:33Reported by EUVDType

In PackageInstaller.Session#transfer of frameworks/base/services/core/java/com/android/server/pm/PackageInstallerSession.java, there is a possible memory exhaustion attack due to a logic error in the code. This could lead to local denial of servic...

Reporter	Title	Published	Views	Family All 4
Android Security Bulletins	Android 17 Security Release NotesStay organized with collectionsSave and categorize content based on your preferences.	16 Jun 202600:00	–	androidsecurity
CVE	CVE-2026-28575	17 Jun 202607:02	–	cve
Cvelist	CVE-2026-28575	17 Jun 202607:02	–	cvelist
Positive Technologies	PT-2026-50239	17 Jun 202600:00	–	ptsecurity

[
  {
    "enisaIdVendor": [
      {
        "id": "576f2332-6f3f-3849-bd71-c45e4fbd2f87",
        "vendor": {
          "name": "Google"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "018a5c96-19f1-38b7-a95c-bd26d57cd40a",
        "product": {
          "name": "Android",
          "vendor": {
            "name": "Google"
          }
        },
        "product_version": "17"
      }
    ]
  }
]

Source	Link
source	www.source.android.com/docs/security/bulletin/android-17

17 Jun 2026 07:02Current

5.6Medium risk

Vulners AI Score5.6

CVSS 410