CVE-2025-26463: 
NixOS vulnerability analysis and mitigation

CVE-2025-26463 is a resource exhaustion vulnerability discovered in Android's allowPackageAccess functionality affecting Android versions 13.0, 14.0, and 15.0. The vulnerability was disclosed on September 4, 2025, and allows for a local persistent denial of service attack without requiring additional execution privileges or user interaction (NVD CVE).

The vulnerability exists in the allowPackageAccess functionality of multiple files where resource exhaustion can occur when repeatedly adding allowed packages. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The weakness has been categorized as CWE-400 (Uncontrolled Resource Consumption) (NVD CVE).

The vulnerability can lead to a local persistent denial of service, affecting system availability. The attack does not impact system confidentiality or integrity but can cause significant disruption to system operations (NVD CVE).

A patch has been released to address this vulnerability through a code change that guards against excessively long package names and certificates. The fix was implemented in the Android framework base repository (Android Commit).