How is CVE-2026-0064 exploited?

Network reachability (required): The vulnerability is reachable over the network, meaning an attacker can trigger resource exhaustion without requiring local access or physical proximity to the target. Authentication (not-required): No account or credentials of any privilege level are needed to exploit this vulnerability. Victim interaction (not-required): The attacker does not need to trick or involve any user; exploitation proceeds without any human action on the target side. Attack complexity (info): Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or environmental prerequisites.

What is the impact of CVE-2026-0064?

Exhausts system resources on the target Android 17 device or container, causing a persistent denial of service that survives normal operation and requires manual intervention to clear. Confidentiality of data on the affected system is compromised, giving the attacker read access to stored content and system state. Integrity of the affected system is compromised, allowing the attacker to modify persisted data or system configuration. Scope extends beyond the directly affected component: secondary systems and services that depend on the compromised Android environment are also subject to high-severity confidentiality, integrity, and availability impact.

Back to search

CRITICALCVE-2026-0064Published 2026-06-17Modified 2026-06-17CNA google_android

CVE-2026-0064: In multiple places, there is a possible persistent denial of service due to resource exhaustion

In multiple places, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS v4.0: 10.0
Severity: CRITICAL
Fixed in: —
Affected Products: 1

HarborGuard Analysis

Synopsis

Resource exhaustion vulnerability in Google Android 17 allows an attacker to trigger a persistent denial of service across multiple code paths. The flaw is reachable over the network with no authentication or user interaction required, as reflected in the perfect 10.0 CVSS v4.0 score. Successful exploitation exhausts system resources, rendering the device or service permanently unresponsive until manually recovered. No fix version has been published yet; HarborGuard tracks this advisory and will surface a patched-image rebuild the moment upstream ships a fix.

HarborGuard Coverage

Detection

Detection is available across every HarborGuard environment: the CVE is ingested from upstream feeds within minutes of publication and matched against customer images in registries and CI/CD pipelines, including custom-built Android-based images. Any image carrying an affected version of Android 17 is flagged automatically on the next scan cycle.

Available

Triage

HarborGuard scores this CVE at CRITICAL (CVSS 10.0 v4.0) and surfaces it at the top of each affected environment's vulnerability queue. Per-environment compliance policy weighting is applied to route the finding to the appropriate team inbox within each customer organization.

Available

Patch

Because no fix version has been published, HarborGuard re-checks the advisory on every ingest cycle and will make a patched-image rebuild available automatically the moment upstream releases a patch. Until then, customers can apply compensating controls such as network-policy isolation or egress filtering through the HarborGuard policy interface.

Pending upstream

Exploit Conditions

Network reachabilityRequired
The vulnerability is reachable over the network, meaning an attacker can trigger resource exhaustion without requiring local access or physical proximity to the target.
AuthenticationNot required
No account or credentials of any privilege level are needed to exploit this vulnerability.
Victim interactionNot required
The attacker does not need to trick or involve any user; exploitation proceeds without any human action on the target side.
Attack complexityDetail
Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or environmental prerequisites.

Blast Radius

Exhausts system resources on the target Android 17 device or container, causing a persistent denial of service that survives normal operation and requires manual intervention to clear.
Confidentiality of data on the affected system is compromised, giving the attacker read access to stored content and system state.
Integrity of the affected system is compromised, allowing the attacker to modify persisted data or system configuration.
Scope extends beyond the directly affected component: secondary systems and services that depend on the compromised Android environment are also subject to high-severity confidentiality, integrity, and availability impact.

How HarborGuard Handles This

Available on HarborGuard: because no upstream fix exists for CVE-2026-0064, HarborGuard continuously monitors the advisory across every ingest cycle and will trigger a patched-image rebuild automatically once Google Android publishes a remediation. In the meantime, customers can reduce exposure through compensating controls available in the HarborGuard policy interface, including network-policy isolation to restrict inbound traffic to affected images, egress filtering to limit lateral movement if exploitation occurs, and feature-flag gating to disable non-essential services in affected workloads. For customers with auto-remediation enabled, the moment a fix version is published, HarborGuard will rebuild the affected image at the patched version, run regression tests, and open a PR against affected workloads without manual intervention. Given the CRITICAL severity and zero-interaction attack surface, reviewing exposure in your registry is recommended immediately.

See how HarborGuard automates this

Affected packages

Google / Android
17

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

source.android.com

Metrics

Get notified