What is the CVSS score of EUVD-2026-37566?

EUVD-2026-37566 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. EPSS exploitation probability: 0.2%.

Which versions of Android are affected by EUVD-2026-37566?

Android PackageInstaller vulnerability (CVE-2026-28575) disables app installation and update functionality when triggered by any installed application, blocking critical security patch deployment…

How to fix or mitigate EUVD-2026-37566?

Within 24 hours: Inventory all Android devices and determine OS versions; prioritize business-critical infrastructure. Within 7 days: Deploy mobile device management (MDM) policies to enable application allow-listing and disable sideloading to reduce attack surface. Within 30 days: Monitor Android Security Bulletin for CVE-2026-28575 patch release for affected versions; prepare patch deployment workflow; validate fix in staging environment before organization-wide deployment.

Android EUVD-2026-37566

| CVE-2026-28575 CRITICAL

Uncontrolled Resource Consumption (CWE-400)

2026-06-17 google_android

Google Java Denial Of Service

10.0

CVSS 4.0 · Vendor: google_android

Severity by source

Vendor (google_android) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

vuln.today AI

5.5 MEDIUM

Description specifies local DoS triggerable by any app without user interaction, so AV:L, PR:L, UI:N, A:H only; no confidentiality or integrity impact and no scope change.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (google_android).

CVSS VectorVendor: google_android

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 08:23 vuln.today

CVE Published

Jun 17, 2026 - 07:02 cve.org

CRITICAL 10.0

DescriptionCVE.org

In PackageInstaller.Session#transfer of frameworks/base/services/core/java/com/android/server/pm/PackageInstallerSession.java, there is a possible memory exhaustion attack due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

Articles & Coverage 2

News 5 New Java Vulnerabilities - 2 Critical, 3 High Severity Jun 18, 2026 News Critical Denial of Service in Android PackageInstaller (Java) - CVE-2026-28575 Jun 17, 2026

AnalysisAI

Local denial of service in Android's PackageInstaller subsystem stems from a logic error in PackageInstallerSession.transfer() that allows a local app to trigger memory exhaustion of the system package installer. The flaw, addressed in the Android Security Bulletin for Android 17, can be triggered without user interaction and without elevated privileges, but its impact is confined to denial of service rather than code execution. No public exploit identified at time of analysis.

Technical ContextAI

PackageInstallerSession is part of frameworks/base/services/core/java/com/android/server/pm/, the Java-based package management service that runs in the privileged system_server process on Android. The Session#transfer API is used to hand off an in-progress install session from one installer package to another. A logic error in this transfer path appears to allow uncontrolled allocation or retention of session-state objects, leading to memory exhaustion in system_server. No CWE is assigned in the source data, but the described behavior is consistent with CWE-770 (Allocation of Resources Without Limits or Throttling) or a related resource-management flaw. CPE coverage is limited to cpe:2.3:a:google:android with a wildcard version, so the exact affected codeline must be derived from the Android Security Bulletin rather than NVD CPE data.

RemediationAI

Patch available per vendor advisory: apply the Android security patch level associated with the Android 17 bulletin at https://source.android.com/docs/security/bulletin/android-17 as soon as the OEM and carrier ship it for the affected device. Until the patch is installed, the practical compensating control is to restrict app installation sources to Google Play and known-trusted enterprises (Play Protect on, sideloading off) so that arbitrary local apps cannot reach the vulnerable PackageInstallerSession transfer path; the trade-off is reduced flexibility for users who rely on sideloading or third-party stores. MDM-managed fleets can additionally use device policy to block the INSTALL_PACKAGES permission and disable unknown-sources installation, accepting the operational cost of tighter app distribution control.