Microsoft CVE-2026-39973

Immediately upgrade to Apktool version 3.0.2 or later, available at https://github.com/iBotPeaches/Apktool/releases/tag/v3.0.2, which re-implements path sanitization controls in ResFileDecoder.java to prevent directory traversal during resource extraction. Organizations unable to upgrade immediately should implement the following compensating controls with noted trade-offs: (1) Execute all apktool d operations within containerized environments (Docker, Podman) or virtual machines with isolated filesystems, preventing escape to host system directories but adding operational overhead to analysis workflows. (2) Run Apktool under restricted user accounts with write permissions limited to dedicated output directories outside user home folders, mitigating SSH config and shell profile overwrites but not preventing writes to permitted paths. (3) Deploy mandatory access control systems (SELinux, AppArmor) with policies restricting Apktool file write operations to explicitly whitelisted paths, requiring security expertise to configure correctly and potentially breaking legitimate resource extraction to unexpected locations. (4) Process only APK files from explicitly trusted sources and avoid decoding samples from malware repositories, app stores, or unknown origins without sandboxing, though this limits security research capabilities. For automated analysis pipelines, implement pre-processing validation that inspects resources.arsc Type String Pools for path traversal sequences (../, .\, absolute paths) before invoking Apktool, with the caveat that sophisticated obfuscation may bypass string-based detection. The vendor patch is the only complete mitigation; all workarounds carry operational or security limitations.