CVE-2026-59008

Unknown

Published: 02/11/2026(UTC)Translated: 02/11/2026(UTC)NVD NIST

Summary

In setApplicationRestrictions of DevicePolicyManagerService.java, there is a possible denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed.

Risk Assessment

A local attacker could exhaust resources and make device management services unavailable, potentially disrupting the organization's security policies.

Recommendation

Update Android to a version containing the security fix for this CVE and restrict installation of untrusted applications on managed devices.

Other vulnerabilities in Android DevicePolicyManagerService

CVE-2025-48633MediumActively exploited
In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS