CVE-2026-28575: Android Memory Exhaustion in PackageInstaller—Analysis & Patch Guidance

Technical summary

CVE-2026-28575 is a memory exhaustion vulnerability in PackageInstaller.Session#transfer within Android's PackageInstallerSession.java. The flaw stems from improper resource handling logic that fails to constrain memory consumption during the package transfer operation. An attacker with local access can repeatedly invoke this code path to allocate unbounded memory, exhausting available heap and causing the system to become unstable or crash. The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption).

Business impact

Organizations deploying Android devices face potential service disruption from this vulnerability. Mobile device management systems may experience widespread outages if users interact with malicious installation packages on compromised networks or internal distribution channels. The denial-of-service impact could affect employee productivity and critical workflows on affected Android devices, though data confidentiality and integrity remain unaffected. Devices may require reboot or manual intervention to recover.

Affected systems

This vulnerability affects Google Android devices. The exact impacted versions are not specified in the published advisory—organizations should cross-reference the vendor's security bulletin for precise version coverage. Typically, Android security patches are released through monthly security updates; affected devices will be identified in Google's official documentation.

Exploitability

The vulnerability carries a CVSS 3.1 score of 5.5 (Medium severity) and requires local access to the affected device. No elevated privileges are required—any local user can trigger the memory exhaustion. Exploitation does not require user interaction, meaning background processes or local daemons could be weaponized to attack the system automatically. However, the attack is confined to local denial of service and cannot enable privilege escalation or unauthorized data access.

Remediation

Remediation requires installing the security update provided by Google for affected Android versions. Organizations should identify which Android devices are running vulnerable versions by consulting Google's Android Security & Privacy Year in Review or monthly security bulletin. Devices should be patched according to the organization's mobile device management policy and OS update schedule.

Patch guidance

Verify the specific Android version(s) affected by referencing Google's official Android Security & Privacy advisory for June 2026 or later. Once identified, deploy the corresponding security patch through your organization's mobile device management platform or direct device update mechanism. Ensure sufficient device storage and battery are available before initiating updates. If available, prioritize devices used in critical operations or those with the highest risk of local compromise.

Detection guidance

Monitor for repeated package installation failures or unexpected system crashes on Android devices, particularly if correlated with app installation activity. System logs may show memory pressure warnings or out-of-memory errors preceding crashes. Device management tools should flag Android devices that have not received the latest monthly security update. Anomalous background process behavior attempting to trigger package installation routines may also indicate exploitation attempts.

Why prioritize this

Although marked as Medium severity, this vulnerability warrants timely patching due to its ease of exploitation (no special privileges required) and potential for widespread denial of service across an organization's Android fleet. Organizations with bring-your-own-device or shared device policies should prioritize faster deployment, as local access is readily available in these scenarios.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects the local attack vector, lack of privilege requirement, and high availability impact. The score does not account for business context—organizations relying heavily on mobile devices or supporting remote work may assess internal risk as higher due to operational impact.

Frequently asked questions