CVE-2026-28666 Overview
CVE-2026-28666 is an authorization flaw [CWE-863] in multiple functions of LocalImageResolver.java on Android. Attackers can bypass a Digital Negative (DNG) image rendering check, leading to a Remote Persistent Denial of Service and remote privilege escalation. Exploitation requires no additional execution privileges and no user interaction.
Google disclosed the issue in the Android Security Bulletin September 2026. The vulnerability affects the Android platform component responsible for resolving and rendering local image content.
Critical Impact
Remote attackers can trigger persistent denial of service and escalate privileges on affected Android devices without any user interaction.
Affected Products
- Android platform (LocalImageResolver.java component)
- Devices receiving the September 2026 Android Security Bulletin patches
- OEM Android builds incorporating the affected framework code
Discovery Timeline
- 2026-09-08 - CVE-2026-28666 published to the National Vulnerability Database
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-28666
Vulnerability Analysis
The flaw resides in multiple functions within LocalImageResolver.java, an Android framework class that resolves image URIs into decoded bitmaps. The class enforces a rendering check intended to constrain how DNG raw image files are processed. Attackers can bypass this check by supplying crafted DNG content that evades the validation logic.
Once the check is bypassed, the resolver processes the image outside the intended safety boundary. This leads to a Remote Persistent Denial of Service, meaning the affected component or device state remains disrupted across restarts of the calling context. The advisory also documents remote privilege escalation as a downstream consequence.
The issue is classified under [CWE-863] (Incorrect Authorization), reflecting that the authorization check exists but does not correctly enforce the intended policy on DNG inputs.
Root Cause
The root cause is an incorrect authorization check in the DNG rendering path of LocalImageResolver. The check fails to account for image characteristics that should bar rendering, allowing hostile DNG payloads to reach code paths reserved for validated content. The resulting persistent DoS state indicates the failure leaves durable side effects on the media handling subsystem.
Attack Vector
The attack vector is network-based and requires low privileges, according to the CVSS vector. An attacker delivers a crafted DNG image to a process that invokes LocalImageResolver on the target device. Because user interaction is not required, exploitation can occur when the image is resolved automatically by an application component such as a messaging preview, gallery service, or content provider consumer.
The vulnerability lacks verified public code examples. Consult the Android Security Bulletin September 2026 for authoritative technical detail.
Detection Methods for CVE-2026-28666
Indicators of Compromise
- Repeated crashes or restarts of Android system services or applications that decode images shortly after receiving DNG content.
- Unexpected DNG (.dng) attachments or content URIs delivered through messaging, email, or third-party content providers.
- Persistent failure states in image preview or gallery components that survive process restarts.
Detection Strategies
- Monitor Android logcat output for repeated exceptions originating from LocalImageResolver and related media decoding classes.
- Inspect mobile threat telemetry for delivery of DNG payloads to applications that do not require raw image support.
- Correlate crash telemetry across managed device fleets to identify clusters of failures tied to image resolution paths.
Monitoring Recommendations
- Enroll Android endpoints in a mobile threat defense solution that reports application crashes and framework exceptions.
- Track patch level compliance against the September 2026 Android Security Bulletin across the fleet.
- Alert on inbound DNG files at network and messaging gateways, especially where DNG is not an expected business format.
How to Mitigate CVE-2026-28666
Immediate Actions Required
- Apply the September 2026 Android security patch level or later on all managed devices.
- Prioritize patch deployment on devices that process untrusted images, including corporate messaging and email clients.
- Restrict installation of applications that expose broad content provider access to untrusted senders.
Patch Information
Google addressed CVE-2026-28666 in the September 2026 Android Security Bulletin. Device vendors incorporate the fix into their monthly security patch levels. Confirm the device reports a security patch level of 2026-09-01 or later. Refer to the Android Security Bulletin September 2026 for the authoritative patch reference.
Workarounds
- Block or quarantine DNG attachments at email and messaging gateways where the format is not required.
- Disable automatic image previews in messaging applications on unpatched devices.
- Enforce mobile device management policies that require the September 2026 or later security patch level for access to corporate resources.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.