CVE-2026-0064: Android Resource Exhaustion Denial of Service

Technical summary

This vulnerability is rooted in improper resource handling (CWE-400) across multiple locations in the Android codebase. An attacker with local access and standard user-level privileges can exhaust system resources—such as memory, file descriptors, or other finite system objects—without requiring any special capabilities or user interaction. The persistent nature of the denial of service means the condition persists across reboots or until the underlying resource exhaustion is addressed. The CVSS 3.1 score of 5.5 reflects a medium-severity issue with local attack vector, low complexity, and significant availability impact but no confidentiality or integrity compromise.

Business impact

Organizations deploying Android devices face potential operational disruption if this vulnerability is exploited. A disgruntled insider or compromised local account could render devices unusable, affecting workforce productivity and potentially disrupting critical workflows that depend on mobile infrastructure. The low barrier to exploitation—requiring only standard user credentials—increases organizational risk in BYOD or shared-device environments where multiple users have legitimate local access.

Affected systems

Google Android systems are affected. The vulnerability manifests in multiple code paths, suggesting it is not isolated to a single component but rather a pattern of improper resource handling across the platform. Specific Android versions and devices should be cross-referenced with official Google security advisories and patch releases to determine exact scope.

Exploitability

Exploitability is straightforward from an attacker perspective. The local attack vector combined with low complexity and the absence of privilege escalation requirements or user interaction mean any authenticated user on an affected Android device can trigger the denial of service. However, exploitation is limited to local attackers—remote exploitation is not possible. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting active in-the-wild exploitation may not yet be widespread as of the publication date.

Remediation

Organizations should prioritize deploying the latest security patches released by Google for affected Android versions. Verify your device's Android security patch level against the official Google security bulletin and apply updates as soon as they become available. In the interim, restrict local system access to trusted users and monitor for unusual resource consumption patterns that may indicate exploitation attempts.

Patch guidance

Consult Google's official Android Security & Privacy Advisories to identify the specific Android version and security patch level required to remediate CVE-2026-0064. Patch availability and deployment timelines vary by device manufacturer and carrier. For enterprise deployments, coordinate with your mobile device management (MDM) solution to distribute patches across your fleet. Test patches in a non-production environment before broad rollout to ensure compatibility with your organization's applications and workflows.

Detection guidance

Monitor for sustained system resource exhaustion events on Android devices, particularly memory or file descriptor depletion that occurs without corresponding application crashes. Review system logs for patterns of resource allocation spikes originating from unexpected processes. If possible, enable enhanced logging on your MDM platform to track resource usage anomalies. Detection may be challenging on standard consumer devices due to limited logging; focus monitoring efforts on managed enterprise devices with robust telemetry.

Why prioritize this

While this is a medium-severity vulnerability, its low barrier to exploitation—requiring only standard user privileges and no user interaction—warrants timely but not emergency remediation. Organizations should prioritize patching based on asset criticality and user population risk. Devices used by high-value targets or in sensitive roles should be updated first. The lack of KEV status suggests this is not yet a priority for nation-state actors, allowing organizations a reasonable window for planned patch deployment.

Risk score, explained

The CVSS 3.1 score of 5.5 (Medium) reflects the vulnerability's limited but meaningful impact. The local attack vector (AV:L) restricts the attack surface to users with device access. Low complexity (AC:L) indicates straightforward exploitation. The requirement for low privileges (PR:L) is significant—standard user accounts suffice, widening the potential attacker pool. The high availability impact (A:H) from resource exhaustion justifies the medium rating. Absence of confidentiality or integrity impact prevents a higher score.

Frequently asked questions