What is the CVSS score of CVE-2026-0064?

CVE-2026-0064 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. EPSS exploitation probability: 0.2%.

Which versions of Google Android are affected by CVE-2026-0064?

Critical Android vulnerability CVE-2026-0064 (CVSS 10.0) enables local attackers without privileges to cause permanent device denial of service, affecting all Android devices across your…

How to fix or mitigate CVE-2026-0064?

Within 24 hours: Identify and prioritize Android devices by business criticality; alert users and device administrators of the vulnerability and physical access risks. Within 7 days: Monitor Google Android Security Bulletin and your device vendors for patch release (expected for android-17 release branch and backports to older versions); prepare deployment procedures for rapid patching. Within 30 days: Deploy patches immediately upon vendor release to all affected Android versions; for unpatched devices, restrict physical access and implement additional monitoring.

Google Android CVE-2026-0064

EUVD-2026-37565 CRITICAL

Uncontrolled Resource Consumption (CWE-400)

2026-06-17 google_android

Denial Of Service Google

10.0

CVSS 4.0 · Vendor: google_android

Severity by source

Vendor (google_android) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

vuln.today AI

5.5 MEDIUM

Description states local DoS by an unprivileged app with no user interaction; only availability is affected, so AV:L, PR:L, C:N, I:N, A:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (google_android).

CVSS VectorVendor: google_android

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 08:29 vuln.today

CVE Published

Jun 17, 2026 - 06:59 cve.org

CRITICAL 10.0

DescriptionCVE.org

In multiple places, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

AnalysisAI

Persistent denial of service in Google Android allows local attackers to exhaust device resources in multiple code paths, rendering functionality unavailable until manual intervention. The flaw requires no privileges and no user interaction, and is addressed in the Android Security Bulletin for android-17. No public exploit identified at time of analysis and no EPSS or KEV signal is provided.

Technical ContextAI

The affected component is the Android platform (cpe:2.3:a:google:android), with the issue described as appearing in 'multiple places' - implying several distinct code paths share a resource-management weakness rather than a single isolated bug. Although no CWE is assigned, the description (resource exhaustion leading to persistent unavailability) aligns with the CWE-400 (Uncontrolled Resource Consumption) class, where unchecked allocation, accumulation, or retention of system resources (memory, storage, handles, IPC queues) survives across sessions or reboots, producing a 'persistent' rather than transient outage on the device.

RemediationAI

Apply the security patch level corresponding to the android-17 Android Security Bulletin published at https://source.android.com/docs/security/bulletin/android-17 (patch available per vendor advisory; exact fix build/patch level should be confirmed against the bulletin for the specific device). On managed fleets, push the updated monthly security patch level through MDM and verify devices report the post-fix Security Patch Level under Settings. As compensating controls until patching, restrict installation of untrusted third-party APKs (disable 'Install unknown apps' for non-essential sources), constrain background execution and storage quotas for sideloaded apps via work-profile or device-owner policy, and on shared/kiosk devices enforce automatic reboot windows so any persistent resource exhaustion is cleared periodically - accepting the trade-off of brief scheduled downtime.