CVE-2026-28575: 
NixOS vulnerability analysis and mitigation

CVE-2026-28575 is a local denial-of-service vulnerability in Android 17 caused by a logic error in PackageInstaller.Session#transfer within PackageInstallerSession.java. The flaw enables a memory exhaustion attack that can render the PackageInstaller service unavailable. It was published on June 17, 2026, and affects Google Android version 17.0. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium), though a CVSS v4.0 score of 10.0 (Critical) has also been assigned (Android Security Bulletin).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption), stemming from a logic error in the PackageInstaller.Session#transfer method in frameworks/base/services/core/java/com/android/server/pm/PackageInstallerSession.java. A local attacker with low privileges can trigger uncontrolled memory consumption through this code path, exhausting system memory and causing a denial-of-service condition. No user interaction is required for exploitation, and no additional execution privileges beyond a standard low-privilege local account are needed (Android Security Bulletin).

Successful exploitation leads to a local denial-of-service condition, specifically memory exhaustion that can crash or render the PackageInstaller service unavailable. The impact is limited to availability — there is no confidentiality or integrity impact. Because PackageInstaller is a core Android system service, its unavailability could disrupt app installation and management functionality on the affected device (Android Security Bulletin).

Google has released a patch addressing this vulnerability as part of the Android 17 security bulletin published June 17, 2026. Users and administrators should apply the security update provided through the Android security bulletin. As interim mitigations, restricting local device access through user account management and monitoring system memory usage for anomalous patterns may help reduce risk (Android Security Bulletin).