medium · CVSS v3 5.5

CVE-2026-59008

CVE-2026-59008 is a denial‑of‑service vulnerability in Android's DevicePolicyManagerService. An attacker can trigger resource exhaustion by

Overview

CVE-2026-59008 is a denial‑of‑service vulnerability in Android's DevicePolicyManagerService. An attacker can trigger resource exhaustion by calling setApplicationRestrictions, causing the device to become unresponsive. The flaw requires no elevated privileges or user interaction.

Description

In setApplicationRestrictions of DevicePolicyManagerService.java, there is a possible denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

Impact

The vulnerability can cause local denial of service on affected Android devices, potentially disrupting user productivity and critical services. It affects all Android versions that include the DevicePolicyManagerService implementation. Defenders should monitor for abnormal CPU/memory usage and ensure devices are patched.

Remediation

Apply the latest Android security patch that fixes the setApplicationRestrictions resource exhaustion bug. If immediate patching is not possible, disable the DevicePolicyManagerService or restrict its usage via device admin policies. Monitor device logs for repeated calls to setApplicationRestrictions.

Risk context

Severity is medium (CVSS 5.5). No EPSS data available. The issue can be exploited locally without user interaction, so defenders should treat it as a moderate risk that could impact device availability.

Affected products

  • Android OS
  • Google DevicePolicyManager

Scores

Severity
medium
CVSS v2
2.1
CVSS v3
5.5
CVSS v4
—
EPSS
—

denial-of-service resource-exhaustion device-policy android local medium

← All CVEs

Related CVEs

medium

CVE-2026-120237

A flaw in ag-ui-protocol ag-ui up to 0.0.58 allows manipulation of the isInterruptExpired function, leading to excessive resource consumption. The vulnerability can be exploited remotely and an exploit is publicly available. Patching to a fixed version is required to mitigate the risk.

View analysis

medium

CVE-2026-120334

A path‑traversal flaw exists in deepset‑ai farm 0.8.0 and earlier, allowing remote attackers to read arbitrary files via the vocab_filename argument in EmbeddingTokenizer.from_pretrained. The vulnerability is publicly known and can be exploited without authentication. It affects any deployments of the unsupported farm library.

View analysis

medium

CVE-2026-120343

A cross-site scripting (XSS) vulnerability exists in the manageassessment2.php file of the CloudClassroom-PHP-Project. This flaw allows remote attackers to inject malicious scripts via the ExamName and question parameters. The issue is significant because the vendor is unresponsive, leaving users without an official patch.

View analysis

medium

CVE-2026-49924

In ShortcutInfo of ShortcutInfo.java, there is a possible way to crash the launcher via unauthorized shortcuts due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

View analysis