CVE-2026-0074: Android LauncherProcessImageListener Denial of Service Vulnerability

Technical summary

The vulnerability resides in LauncherProcessImageListener.kt within the Android platform. The getPreferredSize method fails to properly validate or limit resource allocation when processing image dimensions, allowing an attacker to trigger uncontrolled resource consumption (CWE-400). The attack vector is local; the attacker must have shell-level access to the device. Once triggered, the exhaustion of memory, CPU, or other system resources causes denial of service to the launcher and potentially affects overall system stability.

Business impact

For enterprise Android deployments—including shared devices, managed endpoints, and multi-tenant scenarios—this vulnerability creates operational risk. A compromised or malicious app running with local privileges can disable the launcher without administrator intervention, rendering the device difficult to use. For consumer users, the impact is lower but still relevant if device is shared or if a sideloaded app gains local access. Organizations managing large Android fleets should assess whether their threat model includes local attackers or compromised processes within the same device.

Affected systems

The vulnerability affects Google Android. Specific version ranges and patch availability should be verified against Google's Android Security & Privacy Year in Review and official manufacturer security bulletins, as the provided data does not enumerate granular version boundaries.

Exploitability

Exploitation requires local access—an attacker cannot trigger this remotely over the network. An existing local account, compromised shell access, or a malicious app running under an unprivileged user context can exploit it. The attack is straightforward to execute once local presence is established; no special tools or user interaction are needed. The CVSS score of 5.5 (Medium) reflects the local-only attack vector combined with high availability impact but no confidentiality or integrity compromise.

Remediation

Apply the latest Android security update from your device manufacturer or Google. The core fix involves adding resource limits and validation within getPreferredSize to prevent unbounded allocation. Users should prioritize patching if their device is running a version known to include this flaw.

Patch guidance

Check your device manufacturer's security bulletin or Google's official Android Security & Privacy release notes for the patch date and affected release levels. Install available OTA (over-the-air) updates or security patches at the earliest opportunity. For enterprise environments, validate patch deployment through your MDM or device management platform before rolling out widely.

Detection guidance

Monitor for repeated crashes or hangs of the launcher process (com.android.launcher or vendor equivalent). Examine system logs for memory pressure events, out-of-memory (OOM) killer activity, or abnormal CPU spikes coinciding with the launcher. On managed devices, alert on unexpected process restarts of the launcher service. Forensic review of locally-installed apps or shell access patterns may help identify whether an attacker exploited this after gaining initial local foothold.

Why prioritize this

Although the CVSS score is Medium, prioritization depends on your environment. Prioritize if: (1) you manage multi-user or shared Android devices where local attacker scenarios are credible; (2) you run applications from less-trusted sources locally on managed devices; (3) your threat model includes compromised user-space processes. Deprioritize if your Android devices are single-user, locked down, and have no local untrusted code execution paths.

Risk score, explained

CVSS 3.1 score of 5.5 (Medium) is justified by: local-only attack vector (AV:L), low attack complexity (AC:L), requirement for low privileges (PR:L), no user interaction (UI:N), no scope change (S:U), high availability impact (A:H), and no confidentiality or integrity impact (C:N, I:N). The score appropriately reflects a resource-exhaustion flaw that is trivial to exploit locally but cannot be chained into remote compromise on its own.

Frequently asked questions