CVE-2026-0049: LocalImageResolver DoS Vulnerability

CVE-2026-0049 Overview

CVE-2026-0049 is a resource exhaustion vulnerability in Android's LocalImageResolver.java component, specifically within the onHeaderDecoded method. This flaw enables a persistent denial of service condition that can render affected Android devices unusable without requiring user interaction or additional execution privileges.

Critical Impact

Local attackers can exploit this vulnerability to cause persistent denial of service on Android devices through resource exhaustion, potentially requiring a factory reset to restore normal device operation.

Affected Products

• Android devices running vulnerable Android OS versions
• Applications utilizing LocalImageResolver for image processing

Discovery Timeline

• April 6, 2026 - CVE-2026-0049 published to NVD
• April 7, 2026 - Last updated in NVD database

Technical Details for CVE-2026-0049

Vulnerability Analysis

This vulnerability exists in the image header decoding functionality of Android's LocalImageResolver component. The onHeaderDecoded method fails to properly limit resource consumption when processing malformed or specially crafted image headers. Because Android uses this component for local image resolution across various system and application contexts, an attacker can trigger resource exhaustion that persists beyond the initial exploitation attempt.

The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption), indicating that the affected code does not adequately constrain the allocation of resources in response to attacker-controlled input. The local attack vector means an attacker needs either physical access to the device or the ability to place malicious content on the device's local storage.

Root Cause

The root cause stems from inadequate bounds checking and resource management in the onHeaderDecoded callback function within LocalImageResolver.java. When processing image headers, the method does not enforce proper limits on memory allocation or processing cycles, allowing malicious input to consume system resources until the device becomes unresponsive.

The lack of defensive resource quotas means that once triggered, the resource exhaustion can persist across reboots in certain scenarios where the malicious content is cached or stored in locations that are automatically processed during device startup.

Attack Vector

The attack leverages the local attack surface, requiring an attacker to place a specially crafted image file on the target device. This can be achieved through various means including:

• Malicious applications that download or create crafted image files
• Transferring files via USB, Bluetooth, or other local transfer mechanisms
• Exploiting other vulnerabilities to write files to storage

Once the malicious image is present on the device and processed by LocalImageResolver, the onHeaderDecoded method enters a resource consumption loop that exhausts available system memory or CPU cycles, resulting in denial of service.

The vulnerability does not require user interaction—simply having the malicious image present in a location where it will be automatically processed (such as media directories scanned by the system) is sufficient for exploitation.

Detection Methods for CVE-2026-0049

Indicators of Compromise

• Unusual memory consumption spikes in system image processing services
• Device becoming unresponsive during boot or when accessing media content
• Crash logs referencing LocalImageResolver or onHeaderDecoded methods
• Presence of malformed or unusually structured image files in media directories

Detection Strategies

• Monitor system logs for LocalImageResolver crash events or ANR (Application Not Responding) conditions
• Implement file integrity monitoring for media storage directories to detect suspicious image files
• Deploy endpoint detection solutions that can identify resource exhaustion patterns
• Use static analysis tools to scan applications for potential malicious image file generation

Monitoring Recommendations

• Enable verbose logging for Android media scanning services to capture processing anomalies
• Set up alerts for sustained high memory or CPU usage by system image processing components
• Monitor for repeated system service restarts related to media processing
• Track device reboot patterns that may indicate persistent denial of service conditions

How to Mitigate CVE-2026-0049

Immediate Actions Required

• Apply the latest Android security updates from the Android Security Bulletin April 2026
• Review installed applications and remove any untrusted apps that may introduce malicious image files
• Clear cached media and image thumbnails if experiencing unexplained device slowdowns
• Restrict file transfer capabilities on managed enterprise devices until patches are applied

Patch Information

Google has addressed this vulnerability in the April 2026 Android Security Bulletin. Device manufacturers and carriers are responsible for distributing the security update to end users. Users should check their device settings for available system updates and apply them immediately.

For additional details on the security patch, refer to the Android Security Bulletin April 2026.

Workarounds

• Disable automatic media scanning temporarily on sensitive devices until patches can be applied
• Use mobile device management (MDM) solutions to restrict installation of untrusted applications
• Implement application whitelisting to prevent unauthorized apps from writing to media directories
• Consider factory reset if a device is experiencing persistent denial of service symptoms after removing suspicious content

For enterprise environments, administrators should prioritize patch deployment through their MDM infrastructure and communicate the importance of applying security updates to end users.