CVE-2026-0014

VendorgoogleProductandroidDiscoveredMar 2, 2026UpdatedSep 27, 2026

In isPackageNullOrSystem of AppOpsService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

View graph Watch Export

CVSS v3.1

6.2 MEDIUM

EPSS

0.12%

probability of exploitation in 30 days

CISA KEV

Not listed

no confirmed exploitation reported

News coverage

sources referencing this CVE

Related IOCs

seen in the same coverage

EPSS Trend

Aug 16, 2026 → Sep 30, 2026

▲ 0.02pp

0.09% → 0.12% over 4 tracked changes

CVSS v3.1 Detail

Attack VectorLOCAL

Attack ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

ScopeUNCHANGED

ConfidentialityNONE

IntegrityNONE

AvailabilityHIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Connections

2 relationships

CWE-20

source

Timeline

disclosure → media coverage

Mar 2, 2026

Disclosure — published as a CVE record. · last revised by NVD Sep 27, 2026

Public PoC (1)

github.com/cduram/NotCVE-2026-0014

Unverified third-party code — review before executing.