Android CVE-2026-28666

Exploitation requires the attacker to hold low-privilege access on the target Android device (PR:L per the CVSS vector) - a completely unauthenticated external attacker cannot trigger the flaw directly. The attacker must be able to deliver a malicious DNG image into the LocalImageResolver processing path, which is reachable over the network (AV:N), through vectors such as messaging applications, email clients, or cloud photo synchronization services that automatically process received images. No user interaction is required (UI:N) once the image reaches the resolver. The vulnerability does not require root, system, or any elevated Android permission beyond the baseline needed to submit content to the affected code path. The SSVC 'not automatable' rating indicates that reliable exploitation is not trivially scriptable, likely due to per-device variability or the need to reach the specific processing context. Exploitation is limited to Android versions 14, 15, 16, 16-QPR2, and 17; patched devices are not affected.

The CVSS 8.8 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates a high-severity, network-reachable flaw with low-complexity exploitation and full CIA impact, which on its face warrants urgent patching. However, multiple real-world risk signals temper the urgency considerably: EPSS sits at just 0.18% (7th percentile), SSVC rates current exploitation as 'none' and the attack as 'not automatable', and no CISA KEV listing or public POC code has been identified. The 'not automatable' SSVC assessment is particularly notable - it implies that mass exploitation at scale is not straightforward despite the AC:L CVSS rating, suggesting some non-trivial orchestration is required. The SSVC 'total technical impact' rating aligns with the C:H/I:H/A:H CVSS vector, confirming worst-case outcome if exploitation succeeds. Android's enormous global deployment footprint means even a mid-sized municipal IT team in boleslawiec should treat this as a routine but timely patching priority, consistent with standard monthly Android patch cadence rather than emergency response. The description's framing as 'Remote Persistent Denial of Service' leading to 'privilege escalation' is somewhat unusual - analysts should verify the precise exploitation chain against the September 2026 bulletin, as the two outcomes imply different attack goals.

An attacker with low-level access - such as a malicious application installed on the device or content delivered through a network-connected service (messaging, cloud sync, email) - submits a specially crafted DNG image to the LocalImageResolver pipeline without requiring any victim interaction. The malformed DNG bypasses the authorization check in LocalImageResolver.java, allowing the attacker to escalate privileges within the Android framework or induce a persistent denial of service condition affecting image-processing services. No public proof-of-concept code has been identified at time of analysis.