{"id":"CVE-2026-28584","title":"In createSessionInternal of PackageInstallerService.java, there is a possible way to permanently DoS the device due to a logic error in the code","summary":"In createSessionInternal of PackageInstallerService.java, there is a possible way to permanently DoS the device due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. …","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-693"],"vendor":"google","product":"android","affected":["android = 16.0","android = 17.0"],"published":"2026-09-08","updated":"2026-09-15","sourceUpdated":"2026-09-15T14:31:18.700","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28584","references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-09-01","label":"security@android.com"}],"tags":["nvd","cve.org"],"epss":0.00068,"epssPercentile":0.00037,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-10T17:19:12.916893Z"},"ingestedAt":"2026-09-08T19:08:49.643Z","slug":"CVE-2026-28584","body":"## Overview\n\nIn createSessionInternal of PackageInstallerService.java, there is a possible way to permanently DoS the device due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.\n\n## Affected\n\n- `android = 16.0`\n- `android = 17.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":201497,"id":"CVE-2026-28584","ts":1789399510824,"field":"cvss","old":null,"new":"5.5"},{"seq":201496,"id":"CVE-2026-28584","ts":1789399510824,"field":"severity","old":"none","new":"medium"},{"seq":200231,"id":"CVE-2026-28584","ts":1789397086221,"field":"cvss","old":"5.5","new":null},{"seq":200230,"id":"CVE-2026-28584","ts":1789397086221,"field":"severity","old":"medium","new":"none"},{"seq":198155,"id":"CVE-2026-28584","ts":1789391738907,"field":"cvss","old":null,"new":"5.5"},{"seq":198154,"id":"CVE-2026-28584","ts":1789391738907,"field":"severity","old":"none","new":"medium"},{"seq":195948,"id":"CVE-2026-28584","ts":1789383399313,"field":"cvss","old":"5.5","new":null},{"seq":195947,"id":"CVE-2026-28584","ts":1789383399313,"field":"severity","old":"medium","new":"none"},{"seq":194877,"id":"CVE-2026-28584","ts":1789380300344,"field":"cvss","old":null,"new":"5.5"},{"seq":194876,"id":"CVE-2026-28584","ts":1789380300344,"field":"severity","old":"none","new":"medium"},{"seq":193664,"id":"CVE-2026-28584","ts":1789378268839,"field":"cvss","old":"5.5","new":null},{"seq":193663,"id":"CVE-2026-28584","ts":1789378268839,"field":"severity","old":"medium","new":"none"},{"seq":192451,"id":"CVE-2026-28584","ts":1789376233220,"field":"cvss","old":null,"new":"5.5"},{"seq":192450,"id":"CVE-2026-28584","ts":1789376233220,"field":"severity","old":"none","new":"medium"},{"seq":191238,"id":"CVE-2026-28584","ts":1789373126535,"field":"cvss","old":"5.5","new":null},{"seq":191237,"id":"CVE-2026-28584","ts":1789373126535,"field":"severity","old":"medium","new":"none"},{"seq":190023,"id":"CVE-2026-28584","ts":1789369120956,"field":"cvss","old":null,"new":"5.5"},{"seq":190022,"id":"CVE-2026-28584","ts":1789369120956,"field":"severity","old":"none","new":"medium"},{"seq":188810,"id":"CVE-2026-28584","ts":1789368038280,"field":"cvss","old":"5.5","new":null},{"seq":188809,"id":"CVE-2026-28584","ts":1789368038280,"field":"severity","old":"medium","new":"none"},{"seq":187593,"id":"CVE-2026-28584","ts":1789364996454,"field":"cvss","old":null,"new":"5.5"},{"seq":187592,"id":"CVE-2026-28584","ts":1789364996454,"field":"severity","old":"none","new":"medium"},{"seq":186380,"id":"CVE-2026-28584","ts":1789363002313,"field":"cvss","old":"5.5","new":null},{"seq":186379,"id":"CVE-2026-28584","ts":1789363002313,"field":"severity","old":"medium","new":"none"},{"seq":185166,"id":"CVE-2026-28584","ts":1789360969645,"field":"cvss","old":null,"new":"5.5"},{"seq":185165,"id":"CVE-2026-28584","ts":1789360969645,"field":"severity","old":"none","new":"medium"},{"seq":183953,"id":"CVE-2026-28584","ts":1789357943336,"field":"cvss","old":"5.5","new":null},{"seq":183952,"id":"CVE-2026-28584","ts":1789357943336,"field":"severity","old":"medium","new":"none"},{"seq":182205,"id":"CVE-2026-28584","ts":1789354097833,"field":"cvss","old":null,"new":"5.5"},{"seq":182204,"id":"CVE-2026-28584","ts":1789354097833,"field":"severity","old":"none","new":"medium"},{"seq":180998,"id":"CVE-2026-28584","ts":1789352943291,"field":"cvss","old":"5.5","new":null},{"seq":180997,"id":"CVE-2026-28584","ts":1789352943291,"field":"severity","old":"medium","new":"none"},{"seq":179791,"id":"CVE-2026-28584","ts":1789350000956,"field":"cvss","old":null,"new":"5.5"},{"seq":179790,"id":"CVE-2026-28584","ts":1789350000956,"field":"severity","old":"none","new":"medium"},{"seq":178584,"id":"CVE-2026-28584","ts":1789347814247,"field":"cvss","old":"5.5","new":null},{"seq":178583,"id":"CVE-2026-28584","ts":1789347814247,"field":"severity","old":"medium","new":"none"},{"seq":177377,"id":"CVE-2026-28584","ts":1789346180741,"field":"cvss","old":null,"new":"5.5"},{"seq":177376,"id":"CVE-2026-28584","ts":1789346180741,"field":"severity","old":"none","new":"medium"},{"seq":176170,"id":"CVE-2026-28584","ts":1789342751927,"field":"cvss","old":"5.5","new":null},{"seq":176169,"id":"CVE-2026-28584","ts":1789342751927,"field":"severity","old":"medium","new":"none"},{"seq":175954,"id":"CVE-2026-28584","ts":1789342358438,"field":"cvss","old":null,"new":"5.5"},{"seq":175953,"id":"CVE-2026-28584","ts":1789342358438,"field":"severity","old":"none","new":"medium"},{"seq":175494,"id":"CVE-2026-28584","ts":1789338389941,"field":"cvss","old":"5.5","new":null},{"seq":175493,"id":"CVE-2026-28584","ts":1789338389941,"field":"severity","old":"medium","new":"none"},{"seq":174289,"id":"CVE-2026-28584","ts":1789334603575,"field":"cvss","old":null,"new":"5.5"},{"seq":174288,"id":"CVE-2026-28584","ts":1789334603575,"field":"severity","old":"none","new":"medium"},{"seq":173084,"id":"CVE-2026-28584","ts":1789333197352,"field":"cvss","old":"5.5","new":null},{"seq":173083,"id":"CVE-2026-28584","ts":1789333197352,"field":"severity","old":"medium","new":"none"},{"seq":171898,"id":"CVE-2026-28584","ts":1789330883323,"field":"cvss","old":null,"new":"5.5"},{"seq":171897,"id":"CVE-2026-28584","ts":1789330883323,"field":"severity","old":"none","new":"medium"}]}