Description
In parseKnownActivityEmbeddingCerts of ParsingUtils.java, there is a possible permanent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Published: 2026-11-02
Score: 6.2 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply patch
AI Analysis

Impact

The flaw is located in the parseKnownActivityEmbeddingCerts routine of Android's ParsingUtils. The code fails to validate input correctly, allowing crafted data to trigger a permanent denial of service. The impact is a local system crash that does not require elevated privileges or explicit user interaction.

Affected Systems

Android devices built with the Google::Android platform are affected. No specific version information is available, but the exploit can target any release that includes the current ParsingUtils implementation.

Risk and Exploitability

This vulnerability presents a local denial of service. Because no privileges are required and user interaction is unnecessary, a malicious application or embedded data can exploit it on a device. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting it is not widely known to be actively exploited. However, the lack of a patch yet introduces the risk of repeated crashes that may disrupt user experience and system stability.

Generated by OpenCVE AI on November 2, 2026 at 22:45 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the most recent Android security patch released by Google that addresses the ParsingUtils input validation flaw.
  • If possible, disable or prevent the loading of embedded activity certificates that rely on parseKnownActivityEmbeddingCerts, such as by revoking related permissions or uninstalling suspicious apps.
  • Monitor device logs for repeated failures in ParsingUtils and isolate or remove offending applications that trigger the denial of service.

Generated by OpenCVE AI on November 2, 2026 at 22:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 03 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 02 Nov 2026 23:15:00 +0000

Type Values Removed Values Added
Title Local Denial of Service via Improper Input Validation in Android's ParsingUtils
Weaknesses CWE-20
CWE-400

Mon, 02 Nov 2026 22:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google android
Vendors & Products Google
Google android

Mon, 02 Nov 2026 20:00:00 +0000

Type Values Removed Values Added
Description In parseKnownActivityEmbeddingCerts of ParsingUtils.java, there is a possible permanent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
References

Subscriptions

Google Android
cve-icon MITRE

Status: PUBLISHED

Assigner: google_android

Published:

Updated: 2026-11-03T20:21:25.443Z

Reserved: 2026-07-02T05:56:29.149Z

Link: CVE-2026-58817

cve-icon Vulnrichment

Updated: 2026-11-03T20:11:55.868Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-02T20:17:47.083

Modified: 2026-11-03T21:17:39.153

Link: CVE-2026-58817

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-02T23:00:11Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-400

    Uncontrolled Resource Consumption