{
 "month": "2026-04",
 "generated": "2026-10-06T12:05+00:00",
 "majors": {
  "14": {
   "counts": {
    "announced": 1,
    "certain": 1,
    "probable": 0,
    "not_published": 0,
    "not_covered": 0,
    "awaiting": 0
   },
   "advisories": [
    {
     "cve": "CVE-2026-0049",
     "osv_id": "ASB-A-456471290",
     "source": "osv",
     "announced": "2026-04-01",
     "severity": "Critical",
     "types": [
      "DoS"
     ],
     "status": "resolved",
     "brief": {
      "summary": "Two-part fix: external/dng_sdk rewrites the plane loop in dng_opcode_MapTable::ProcessArea so the bound no longer computes fAreaSpec.Plane() + fAreaSpec.Planes() (which can wrap in uint32) and marks dng_area_spec::ScaledOverlap no-sanitize for unsigned-integer-overflow; frameworks/base adds a MIME-type allowlist to LocalImageResolver so images in non-allowlisted formats (including DNG) are rejected.",
      "confidence": "medium",
      "backport_notes": [
       "The two commits are in different repos (external/dng_sdk and frameworks/base); the dng_sdk diff is identical on 14, 15 and 16 (blob 38ee103 -> 49e63a8) and uses the DNG_ATTRIB_NO_SANITIZE macro, whose definition is not shown in the material.",
       "The android-security-14.0.0_r29 tree contains an extra test (resolveImage_asset_invalidMimeType_withSize) not in the shown diff; its origin is not shown."
      ],
      "meta": {
       "generated": "2026-10-03",
       "author_model": "claude-fable-5-1",
       "review_model": "claude-opus-5-5",
       "review_corrections": 6,
       "note": "AI-generated from the bulletin, the fixing diffs and their code context, then checked claim by claim by a second model. Statements marked '(general platform knowledge)' are not taken from the material."
      }
     },
     "method": [
      "bug_id"
     ],
     "confidence": "certain",
     "first_fix": {
      "tag": "android-security-14.0.0_r26",
      "date": "2026-04-06",
      "provenance": "security_tag"
     },
     "last_fix": {
      "tag": "android-security-14.0.0_r26",
      "date": "2026-04-06",
      "provenance": "security_tag"
     },
     "public_commits": [
      {
       "project": "platform/external/dng_sdk",
       "sha": "d19069e8178f584ab55e0a2d644beb208ac83ae2",
       "tag": "android-security-14.0.0_r26",
       "provenance": "security_tag",
       "method": "bug_id",
       "confidence": "certain",
       "evidence": null,
       "similarity": null
      },
      {
       "project": "platform/frameworks/base",
       "sha": "d98c9421fff9abfb8191e487d40dea9dfe4e66bc",
       "tag": "android-security-14.0.0_r26",
       "provenance": "security_tag",
       "method": "bug_id",
       "confidence": "certain",
       "evidence": null,
       "similarity": null
      }
     ],
     "n_public_commits": 2,
     "projects": [
      "platform/external/dng_sdk",
      "platform/frameworks/base"
     ]
    }
   ],
   "tags": [
    "android-security-14.0.0_r26"
   ],
   "unannounced": [],
   "coverage": {
    "n_ingested_tags": 30,
    "first_ingested_tag": "android-security-14.0.0_r1",
    "latest_ingested_tag": "android-security-14.0.0_r30",
    "window_base_tag": "android-14.0.0_r1",
    "window_start": "2023-10-04",
    "partial_tags": []
   },
   "platform_update_tags": {},
   "briefs": {
    "CVE-2026-0049": {
     "cve": "CVE-2026-0049",
     "summary": "Two-part fix: external/dng_sdk rewrites the plane loop in dng_opcode_MapTable::ProcessArea so the bound no longer computes fAreaSpec.Plane() + fAreaSpec.Planes() (which can wrap in uint32) and marks dng_area_spec::ScaledOverlap no-sanitize for unsigned-integer-overflow; frameworks/base adds a MIME-type allowlist to LocalImageResolver so images in non-allowlisted formats (including DNG) are rejected.",
     "component": "platform/external/dng_sdk (dng_misc_opcodes.cpp, MapTable opcode) and platform/frameworks/base (com.android.internal.widget.LocalImageResolver, MessagingStyle/ConversationStyle image loading)",
     "weakness": "Unsigned integer overflow (wrap) in loop bound arithmetic in DNG opcode processing; mitigated additionally by input format allowlisting",
     "root_cause": "In source/dng_misc_opcodes.cpp, dng_opcode_MapTable::ProcessArea iterated planes with the condition `plane < fAreaSpec.Plane () + fAreaSpec.Planes ()`, a uint32 addition of area-spec values that can wrap. The commit title (\"Handle underflows\") and the added DNG_ATTRIB_NO_SANITIZE(\"unsigned-integer-overflow\") on dng_area_spec::ScaledOverlap indicate unsigned arithmetic in these functions wraps on crafted input; the bulletin classifies the issue as DoS. On the frameworks/base side, LocalImageResolver previously did not restrict which codec/MIME type was decoded, so DNG input reached the decoder.",
     "fix_analysis": [
      "external/dng_sdk source/dng_misc_opcodes.cpp : dng_opcode_MapTable::ProcessArea: the loop now caches planeStart = fAreaSpec.Plane(), planeCount = fAreaSpec.Planes(), bufferPlanes = buffer.Planes() and uses `plane < bufferPlanes && plane - planeStart < planeCount`. Since plane starts at planeStart and only increments, the subtraction does not wrap and no overflowing addition is performed; the plane index stays below buffer.Planes() before DirtyPixel_uint16 / DoMapArea16 are called.",
      "external/dng_sdk source/dng_misc_opcodes.cpp : dng_area_spec::ScaledOverlap: annotated with DNG_ATTRIB_NO_SANITIZE(\"unsigned-integer-overflow\"). This does not change the arithmetic; it only exempts the function from the unsigned overflow sanitizer (the function body is not in the material).",
      "frameworks/base core/java/com/android/internal/widget/LocalImageResolver.java : the method taking (ImageInfo info, int maxWidth, int maxHeight) now reads info.getMimeType(), lowercases it with Locale.US, and accepts only image/png, image/jpeg, image/webp, image/gif, image/bmp, image/x-ico, image/vnd.wap.wbmp, image/heif, image/heic, image/avif. Any other or null MIME type throws RuntimeException(\"Image mime type (...) is not allowed.\") before the existing DEFAULT_DECODE_HARD_LIMIT_PX size check, aborting decoding of non-allowlisted images at that point.",
      "frameworks/base core/tests/coretests: adds the sample image res/raw/dng_opcode_MapTable_ProcessArea.png and LocalImageResolverTest.resolveImage_asset_invalidMimeType expecting IOException from resolveImage(uri, context). The android-security-14.0.0_r29 tree additionally contains resolveImage_asset_invalidMimeType_withSize expecting RuntimeException from resolveImage(uri, context, 480, 480), which is not part of this diff."
     ],
     "completeness": [
      "In dng_sdk only the plane loop of dng_opcode_MapTable::ProcessArea is corrected arithmetically. dng_area_spec::ScaledOverlap is only exempted from the sanitizer, so any wrap in its arithmetic still occurs silently; the material does not show its body or whether the result is subsequently range-checked.",
      "The material does not show other opcode classes in dng_sdk, so whether sibling opcodes use the same Plane()+Planes() bound cannot be judged.",
      "The LocalImageResolver allowlist only covers images decoded through that class. Other code paths that decode DNG via ImageDecoder/BitmapFactory are not gated by this commit and rely on the dng_sdk change."
     ],
     "behavior_changes": [
      "LocalImageResolver now rejects any image whose MIME type is not in the ten-entry allowlist (including DNG, and null MIME type). Per the tests present at android-security-14.0.0_r29, the rejection surfaces as IOException from resolveImage(Uri, Context) and as RuntimeException from resolveImage(Uri, Context, int, int). Images in other formats will fail to load through this class.",
      "MIME comparison is case-insensitive (Locale.US lowercasing).",
      "In dng_sdk, the MapTable plane loop bound no longer uses the wrapping Plane()+Planes() addition; ScaledOverlap is excluded from unsigned-integer-overflow sanitizer instrumentation."
     ],
     "preconditions": [
      "A DNG image containing a MapTable opcode whose area spec plane values cause the uint32 Plane()+Planes() addition to wrap, decoded through dng_sdk (reached via ImageDecoder, per the Test line 'atest ImageDecoderTest' in the dng_sdk commit).",
      "For the frameworks/base path: the image is resolved by com.android.internal.widget.LocalImageResolver, which per its class comment extracts Drawables for MessagingStyle/ConversationStyle messages. The process in which the decode happens is not stated in the material."
     ],
     "per_major": {
      "14": "same fix: both commits landed in android-security-14.0.0_r26 (external/dng_sdk d19069e8178f and frameworks/base d98c9421fff9); at android-security-14.0.0_r29 the patched region is present (8/8 lines).",
      "15": "same fix: external/dng_sdk b8207c04aeeb in android-security-15.0.0_r14 with the identical dng_misc_opcodes.cpp diff; patched region present at android-security-15.0.0_r17 (8/8 lines). The frameworks/base commit for 15 is not shown in the material.",
      "16": "same fix: external/dng_sdk 80a267ed1ac7 in android-security-16.0.0_r5 with the identical diff; patched region present at android-security-16.0.0_r8 (8/8 lines). The frameworks/base commit for 16 is not shown in the material.",
      "17": "not affected per the bulletin; android-security-17.0.0_r1 contains the patched region (8/8 lines)."
     },
     "backport_notes": [
      "The two commits are in different repos (external/dng_sdk and frameworks/base); the dng_sdk diff is identical on 14, 15 and 16 (blob 38ee103 -> 49e63a8) and uses the DNG_ATTRIB_NO_SANITIZE macro, whose definition is not shown in the material.",
      "The android-security-14.0.0_r29 tree contains an extra test (resolveImage_asset_invalidMimeType_withSize) not in the shown diff; its origin is not shown."
     ],
     "confidence": "medium",
     "unknowns": [
      "The body of dng_area_spec::ScaledOverlap and which arithmetic in it overflows; whether a wrapped result is used unchecked.",
      "The exact failure mode before the fix (for example a sanitizer abort versus out-of-range access), whether dng_sdk is built with the integer overflow sanitizer, and the process in which the crash occurs.",
      "Whether other opcode classes in dng_sdk use the same Plane()+Planes() loop bound.",
      "How both resolveImage overloads route through the allowlisted method, and which commit added the sized-variant test.",
      "The frameworks/base cherry-picks for Android 15 and 16 (only the dng_sdk commits are shown for those branches)."
     ],
     "meta": {
      "generated": "2026-10-03",
      "author_model": "claude-fable-5-1",
      "review_model": "claude-opus-5-5",
      "review_corrections": 6,
      "note": "AI-generated from the bulletin, the fixing diffs and their code context, then checked claim by claim by a second model. Statements marked '(general platform knowledge)' are not taken from the material."
     }
    }
   }
  },
  "15": {
   "counts": {
    "announced": 1,
    "certain": 1,
    "probable": 0,
    "not_published": 0,
    "not_covered": 0,
    "awaiting": 0
   },
   "advisories": [
    {
     "cve": "CVE-2026-0049",
     "osv_id": "ASB-A-456471290",
     "source": "osv",
     "announced": "2026-04-01",
     "severity": "Critical",
     "types": [
      "DoS"
     ],
     "status": "resolved",
     "brief": {
      "summary": "Two-part fix: external/dng_sdk rewrites the plane loop bound in dng_opcode_MapTable::ProcessArea so that fAreaSpec.Plane() + fAreaSpec.Planes() is no longer computed and marks dng_area_spec::ScaledOverlap as no-sanitize for unsigned-integer-overflow; frameworks/base adds a MIME-type allowlist to LocalImageResolver so that formats not on the list (e.g. DNG) are rejected.",
      "confidence": "medium",
      "backport_notes": [
       "The two commits touch different projects, so the diffs show no ordering dependency between them. The dng_sdk change uses the DNG_ATTRIB_NO_SANITIZE macro as-is; confirm it is defined in older dng_sdk snapshots. For Android 14 the material shows only the frameworks/base commit."
      ],
      "meta": {
       "generated": "2026-10-02",
       "author_model": "claude-fable-5-1",
       "review_model": "claude-opus-5-5",
       "review_corrections": 8,
       "note": "AI-generated from the bulletin, the fixing diffs and their code context, then checked claim by claim by a second model. Statements marked '(general platform knowledge)' are not taken from the material."
      }
     },
     "method": [
      "bug_id"
     ],
     "confidence": "certain",
     "first_fix": {
      "tag": "android-security-15.0.0_r14",
      "date": "2026-04-06",
      "provenance": "security_tag"
     },
     "last_fix": {
      "tag": "android-security-15.0.0_r14",
      "date": "2026-04-06",
      "provenance": "security_tag"
     },
     "public_commits": [
      {
       "project": "platform/external/dng_sdk",
       "sha": "b8207c04aeeb937bf5c60cbe223434a6a45529e1",
       "tag": "android-security-15.0.0_r14",
       "provenance": "security_tag",
       "method": "bug_id",
       "confidence": "certain",
       "evidence": null,
       "similarity": null
      },
      {
       "project": "platform/frameworks/base",
       "sha": "7f86561367035815b59f8fd6fd9d64e6cd36395f",
       "tag": "android-security-15.0.0_r14",
       "provenance": "security_tag",
       "method": "bug_id",
       "confidence": "certain",
       "evidence": null,
       "similarity": null
      }
     ],
     "n_public_commits": 2,
     "projects": [
      "platform/external/dng_sdk",
      "platform/frameworks/base"
     ]
    }
   ],
   "tags": [
    "android-security-15.0.0_r14"
   ],
   "unannounced": [],
   "coverage": {
    "n_ingested_tags": 18,
    "first_ingested_tag": "android-security-15.0.0_r1",
    "latest_ingested_tag": "android-security-15.0.0_r18",
    "window_base_tag": "android-15.0.0_r1",
    "window_start": "2024-09-03",
    "partial_tags": []
   },
   "platform_update_tags": {},
   "briefs": {
    "CVE-2026-0049": {
     "cve": "CVE-2026-0049",
     "summary": "Two-part fix: external/dng_sdk rewrites the plane loop bound in dng_opcode_MapTable::ProcessArea so that fAreaSpec.Plane() + fAreaSpec.Planes() is no longer computed and marks dng_area_spec::ScaledOverlap as no-sanitize for unsigned-integer-overflow; frameworks/base adds a MIME-type allowlist to LocalImageResolver so that formats not on the list (e.g. DNG) are rejected.",
     "component": "platform/external/dng_sdk (DNG opcode processing, source/dng_misc_opcodes.cpp) and platform/frameworks/base (com.android.internal.widget.LocalImageResolver)",
     "weakness": "Unsigned integer overflow/wrap in a loop bound computed from opcode area-spec fields (fAreaSpec.Plane() + fAreaSpec.Planes()), plus no codec allowlist in the framework image loader",
     "root_cause": "In dng_opcode_MapTable::ProcessArea the per-plane loop was bounded by `plane < fAreaSpec.Plane () + fAreaSpec.Planes ()`. These values come from the MapTable opcode's area spec, so the uint32 addition can wrap. The commit message calls this \"underflows\". The diff removes the addition and separately annotates dng_area_spec::ScaledOverlap with DNG_ATTRIB_NO_SANITIZE(\"unsigned-integer-overflow\"). This suggests that unsigned wrap in these routines made decoding abort under the integer sanitizer, which fits the bulletin's DoS classification, but the material does not show the crash directly. On the framework side, LocalImageResolver put no codec restriction on the images it decoded, so DNG content (as in the added test resource) reached the DNG decoder.",
     "fix_analysis": [
      "source/dng_misc_opcodes.cpp : dng_opcode_MapTable::ProcessArea (dng_sdk commit b8207c04aeeb): caches planeStart = fAreaSpec.Plane(), planeCount = fAreaSpec.Planes() and bufferPlanes = buffer.Planes(). The loop becomes `for (plane = planeStart; plane < bufferPlanes && plane - planeStart < planeCount; ++plane)`. The addition planeStart + planeCount is no longer evaluated. `plane - planeStart` cannot underflow because plane starts at planeStart and only increments, and `plane < bufferPlanes` keeps plane from wrapping. The change is wrapped in BEGIN/END GOOGLE MODIFICATION markers.",
      "source/dng_misc_opcodes.cpp : dng_area_spec::ScaledOverlap (same commit): adds DNG_ATTRIB_NO_SANITIZE(\"unsigned-integer-overflow\"). The function's arithmetic is not changed; the diff shows only the attribute.",
      "core/java/com/android/internal/widget/LocalImageResolver.java (frameworks/base commit 7f8656136703): in the helper that receives an ImageInfo plus maxWidth/maxHeight, before the existing DEFAULT_DECODE_HARD_LIMIT_PX size check, the code reads info.getMimeType() and lower-cases it with Locale.US. It accepts only image/png, image/jpeg, image/webp, image/gif, image/bmp, image/x-ico, image/vnd.wap.wbmp, image/heif, image/heic and image/avif. Any other value, including null, throws RuntimeException(\"Image mime type (...) is not allowed.\").",
      "core/tests/coretests: adds a raw resource dng_opcode_MapTable_ProcessArea.png. The test comment says \"dng mimetype is not supported\", so the resource is presumably the DNG sample despite its name. It also adds LocalImageResolverTest.resolveImage_asset_invalidMimeType, which expects IOException from LocalImageResolver.resolveImage(uri, mContext). At android-security-15.0.0_r17 a second test, resolveImage_asset_invalidMimeType_withSize, expects RuntimeException from resolveImage(uri, mContext, 480, 480). That second test is not part of the r14 commit shown."
     ],
     "completeness": [
      "dng_sdk: only the plane loop in dng_opcode_MapTable::ProcessArea is rewritten. ScaledOverlap is handled by suppressing the sanitizer, not by changing its arithmetic, so wrapped values there are tolerated rather than rejected. The material does not show whether the resulting rectangle is checked elsewhere.",
      "dng_sdk: the fix adds no parse-time validation of fAreaSpec.Plane()/Planes(). Other opcodes that use dng_area_spec are not touched, and the material does not show their loop bounds.",
      "frameworks/base: the allowlist is applied only in one LocalImageResolver helper. Other ImageDecoder users are not changed by this commit.",
      "The MIME allowlist blocks non-listed formats such as DNG in LocalImageResolver rather than fixing DNG parsing."
     ],
     "behavior_changes": [
      "LocalImageResolver now rejects images whose MIME type is null or not in the ten-entry allowlist by throwing RuntimeException. Per the added tests, resolveImage(uri, context) surfaces this as IOException and, at r17, resolveImage(uri, context, 480, 480) surfaces it as RuntimeException. Images in formats outside the list, such as DNG, will no longer load through LocalImageResolver.",
      "dng_sdk: the MapTable plane loop now runs at most planeCount planes, clipped to buffer.Planes(), without computing Plane+Planes. ScaledOverlap is exempt from the unsigned-integer-overflow sanitizer."
     ],
     "preconditions": [
      "A crafted DNG image containing a MapTable opcode whose area-spec Plane/Planes values make the uint32 sum wrap (or that drives unsigned wrap in dng_area_spec::ScaledOverlap) must be decoded by dng_sdk.",
      "Framework path: the image must be passed to LocalImageResolver, which per its class comment extracts Drawables for MessagingStyle/ConversationStyle messages.",
      "The commit's Test line (atest ImageDecoderTest) indicates the issue is reached through ImageDecoder. The material does not state which process does the decoding."
     ],
     "per_major": {
      "14": "Resolved per bug_id at android-security-14.0.0_r26 with frameworks/base commit d98c9421fff9, the same LocalImageResolver allowlist as on 15 (hunk at line 256 instead of 259). 8/8 lines of the patched region are present at android-security-14.0.0_r29. No dng_sdk commit for Android 14 appears in the material.",
      "15": "Resolved at android-security-15.0.0_r14 with external/dng_sdk b8207c04aeeb (MapTable loop and ScaledOverlap no-sanitize) and frameworks/base 7f8656136703 (MIME allowlist). 8/8 lines of the patched region are present at android-security-15.0.0_r17, which also carries a second test (resolveImage_asset_invalidMimeType_withSize).",
      "16": "Resolved at android-security-16.0.0_r5 with dng_sdk commit 80a267ed1ac7 (same diff as on 15). 8/8 lines of the patched region are present at android-security-16.0.0_r8. The material shows no frameworks/base commit for 16.",
      "17": "Not affected: the bulletin does not list Android 17. 8/8 lines of the patched region are present at android-security-17.0.0_r1."
     },
     "backport_notes": [
      "The two commits touch different projects, so the diffs show no ordering dependency between them. The dng_sdk change uses the DNG_ATTRIB_NO_SANITIZE macro as-is; confirm it is defined in older dng_sdk snapshots. For Android 14 the material shows only the frameworks/base commit."
     ],
     "confidence": "medium",
     "unknowns": [
      "The body of dng_area_spec::ScaledOverlap and which unsigned operation wraps there; the diff adds only the attribute.",
      "Whether the wrapping loop bound only caused a sanitizer abort or could also lead to out-of-range plane access without the sanitizer; the bulletin classifies the issue as DoS only.",
      "Whether the dng_sdk commit was applied to Android 14, and whether a frameworks/base commit exists for Android 16.",
      "The name of the LocalImageResolver method that received the allowlist, and which callers reach it.",
      "Which process decodes images through LocalImageResolver."
     ],
     "meta": {
      "generated": "2026-10-02",
      "author_model": "claude-fable-5-1",
      "review_model": "claude-opus-5-5",
      "review_corrections": 8,
      "note": "AI-generated from the bulletin, the fixing diffs and their code context, then checked claim by claim by a second model. Statements marked '(general platform knowledge)' are not taken from the material."
     }
    }
   }
  },
  "16": {
   "counts": {
    "announced": 1,
    "certain": 1,
    "probable": 0,
    "not_published": 0,
    "not_covered": 0,
    "awaiting": 0
   },
   "advisories": [
    {
     "cve": "CVE-2026-0049",
     "osv_id": "ASB-A-456471290",
     "source": "osv",
     "announced": "2026-04-01",
     "severity": "Critical",
     "types": [
      "DoS"
     ],
     "status": "resolved",
     "brief": {
      "summary": "Two-part fix: external/dng_sdk rewrites the plane loop bound in dng_opcode_MapTable::ProcessArea so the overflow-prone sum Plane()+Planes() is no longer computed (and marks dng_area_spec::ScaledOverlap as no-sanitize for unsigned-integer-overflow), while frameworks/base adds a MIME type allowlist to LocalImageResolver so that codecs not on the list, such as DNG, are rejected.",
      "confidence": "medium",
      "backport_notes": [
       "The two commits are in separate projects and touch separate code; the dng_sdk loop change is the arithmetic fix, and the frameworks/base allowlist hardens one entry path. For dng_sdk, confirm the target tree has fBlackAdjustedTable and DNG_ATTRIB_NO_SANITIZE (both referenced by the diff), and keep the GOOGLE MODIFICATION markers.",
       "For frameworks/base, apply the allowlist in the ImageInfo-taking method immediately before the DEFAULT_DECODE_HARD_LIMIT_PX check. The Android 14 diff is identical to the Android 16 one apart from a 3-line hunk offset."
      ],
      "meta": {
       "generated": "2026-10-02",
       "author_model": "claude-fable-5-1",
       "review_model": "claude-opus-5-5",
       "review_corrections": 6,
       "note": "AI-generated from the bulletin, the fixing diffs and their code context, then checked claim by claim by a second model. Statements marked '(general platform knowledge)' are not taken from the material."
      }
     },
     "method": [
      "bug_id"
     ],
     "confidence": "certain",
     "first_fix": {
      "tag": "android-security-16.0.0_r5",
      "date": "2026-04-06",
      "provenance": "security_tag"
     },
     "last_fix": {
      "tag": "android-security-16.0.0_r5",
      "date": "2026-04-06",
      "provenance": "security_tag"
     },
     "public_commits": [
      {
       "project": "platform/external/dng_sdk",
       "sha": "80a267ed1ac714acff455e85ae28c1732777d5b6",
       "tag": "android-security-16.0.0_r5",
       "provenance": "security_tag",
       "method": "bug_id",
       "confidence": "certain",
       "evidence": null,
       "similarity": null
      },
      {
       "project": "platform/frameworks/base",
       "sha": "78ec493d6192240da0d0d37be93c6921eff403e7",
       "tag": "android-security-16.0.0_r5",
       "provenance": "security_tag",
       "method": "bug_id",
       "confidence": "certain",
       "evidence": null,
       "similarity": null
      }
     ],
     "n_public_commits": 2,
     "projects": [
      "platform/external/dng_sdk",
      "platform/frameworks/base"
     ]
    }
   ],
   "tags": [
    "android-security-16.0.0_r5"
   ],
   "unannounced": [],
   "coverage": {
    "n_ingested_tags": 9,
    "first_ingested_tag": "android-security-16.0.0_r1",
    "latest_ingested_tag": "android-security-16.0.0_r9",
    "window_base_tag": "android-16.0.0_r2",
    "window_start": "2025-06-10",
    "partial_tags": []
   },
   "platform_update_tags": {},
   "briefs": {
    "CVE-2026-0049": {
     "cve": "CVE-2026-0049",
     "summary": "Two-part fix: external/dng_sdk rewrites the plane loop bound in dng_opcode_MapTable::ProcessArea so the overflow-prone sum Plane()+Planes() is no longer computed (and marks dng_area_spec::ScaledOverlap as no-sanitize for unsigned-integer-overflow), while frameworks/base adds a MIME type allowlist to LocalImageResolver so that codecs not on the list, such as DNG, are rejected.",
     "component": "platform/external/dng_sdk (DNG opcode processing, dng_misc_opcodes.cpp) and platform/frameworks/base (com.android.internal.widget.LocalImageResolver, MessagingStyle/ConversationStyle image loading)",
     "weakness": "Unsigned integer overflow in loop-bound arithmetic on DNG opcode area-spec fields (fAreaSpec.Plane() + fAreaSpec.Planes()); the bulletin classifies the impact as denial of service",
     "root_cause": "In source/dng_misc_opcodes.cpp, dng_opcode_MapTable::ProcessArea iterated planes with the condition `plane < fAreaSpec.Plane () + fAreaSpec.Planes ()`. Both operands come from the opcode's area spec (presumably parsed from the DNG file), so the uint32 addition can wrap. The commit title (\"Handle underflows\") and the added DNG_ATTRIB_NO_SANITIZE(\"unsigned-integer-overflow\") on dng_area_spec::ScaledOverlap indicate that the arithmetic in these functions overflows on crafted input. The material does not state the exact failure mode beyond the bulletin's DoS classification. On the framework side, LocalImageResolver passed images to ImageDecoder with no codec restriction. The added test uses a DNG sample (dng_opcode_MapTable_ProcessArea) and notes \"dng mimetype is not supported\", which indicates that such an image could reach the dng_sdk code through this path.",
     "fix_analysis": [
      "external/dng_sdk source/dng_misc_opcodes.cpp : dng_opcode_MapTable::ProcessArea: the loop now captures planeStart = fAreaSpec.Plane(), planeCount = fAreaSpec.Planes() and bufferPlanes = buffer.Planes() once, and uses the condition `plane < bufferPlanes && plane - planeStart < planeCount`. Because plane starts at planeStart and only increments, plane - planeStart does not wrap, and the overflowing sum Plane()+Planes() is no longer computed. The change is wrapped in BEGIN/END GOOGLE MODIFICATION markers.",
      "external/dng_sdk source/dng_misc_opcodes.cpp : dng_area_spec::ScaledOverlap: annotated with DNG_ATTRIB_NO_SANITIZE(\"unsigned-integer-overflow\"). This suppresses the sanitizer for that function rather than changing its arithmetic; the body of ScaledOverlap is not shown in the diff.",
      "frameworks/base core/java/com/android/internal/widget/LocalImageResolver.java: in the method that takes ImageDecoder.ImageInfo plus maxWidth/maxHeight, directly before the DEFAULT_DECODE_HARD_LIMIT_PX size check, the code reads info.getMimeType(), lower-cases it with Locale.US, and accepts only image/png, image/jpeg, image/webp, image/gif, image/bmp, image/x-ico, image/vnd.wap.wbmp, image/heif, image/heic and image/avif. Any other MIME type, or a null one, throws RuntimeException(\"Image mime type (...) is not allowed.\").",
      "frameworks/base core/tests/coretests: adds the raw resource dng_opcode_MapTable_ProcessArea.png and the test resolveImage_asset_invalidMimeType, which expects IOException from LocalImageResolver.resolveImage(uri, mContext). At android-security-16.0.0_r8 a second test, resolveImage_asset_invalidMimeType_withSize, expects RuntimeException from resolveImage(uri, mContext, 480, 480); that test is not part of the shown commit."
     ],
     "completeness": [
      "dng_sdk: only the plane loop in dng_opcode_MapTable::ProcessArea is rewritten. The ScaledOverlap change only disables the sanitizer: its arithmetic is unchanged and the diff adds no validation of its result.",
      "dng_sdk: other opcode classes in dng_misc_opcodes.cpp are not touched by this commit; the material does not show whether they use the same Plane()+Planes() bound pattern.",
      "frameworks/base: the allowlist applies only to LocalImageResolver's ImageDecoder path. Other callers of ImageDecoder or BitmapFactory that decode DNG are not covered by it and rely on the dng_sdk fix alone.",
      "frameworks/base: the allowlist rejects every MIME type that is not listed (not only DNG), including a null MIME type."
     ],
     "behavior_changes": [
      "LocalImageResolver now refuses to decode any image whose ImageDecoder-reported MIME type is not in the ten-entry allowlist, and throws RuntimeException. The added test expects resolveImage(uri, context) to surface this as IOException; the later test at r8 expects the sized overload to surface it as RuntimeException.",
      "Images in formats that are not listed (such as DNG), or whose getMimeType() returns null, no longer load through LocalImageResolver.",
      "dng_opcode_MapTable::ProcessArea processes the same planes as before for well-formed input. For inputs where Plane()+Planes() would wrap, the loop is bounded by buffer.Planes() and planeCount without computing the wrapping sum."
     ],
     "preconditions": [
      "A crafted DNG image whose opcode list contains a MapTable opcode with dng_area_spec Plane/Planes values whose uint32 sum wraps (and/or values that overflow in dng_area_spec::ScaledOverlap).",
      "The image must be decoded by the DNG decoder (external/dng_sdk). The frameworks/base commit targets LocalImageResolver, which its class comment describes as extracting Drawables from MessagingStyle/ConversationStyle messages.",
      "Per index search, the only other dng_sdk-related platform code surfaced is frameworks/av/media/img_utils/src/DngUtils.cpp (OpcodeListBuilder), which builds DNG opcode lists rather than parsing them; it does not appear to consume the patched code."
     ],
     "per_major": {
      "14": "frameworks/base fix d98c9421fff9 (same MIME allowlist, same test) landed in android-security-14.0.0_r26; 8/8 patched lines present at android-security-14.0.0_r29. The material does not show a dng_sdk commit for Android 14.",
      "15": "dng_sdk fix b8207c04aeeb (diff identical to the Android 16 commit) landed in android-security-15.0.0_r14; 8/8 patched lines present at android-security-15.0.0_r17. The material does not show a frameworks/base commit for Android 15.",
      "16": "Both commits landed in android-security-16.0.0_r5: dng_sdk 80a267ed1ac7 and frameworks/base 78ec493d6192. 8/8 patched lines present at android-security-16.0.0_r8, where an additional sized-overload test also exists.",
      "17": "Not affected (not listed by the bulletin); 8/8 patched-region lines present at android-security-17.0.0_r1."
     },
     "backport_notes": [
      "The two commits are in separate projects and touch separate code; the dng_sdk loop change is the arithmetic fix, and the frameworks/base allowlist hardens one entry path. For dng_sdk, confirm the target tree has fBlackAdjustedTable and DNG_ATTRIB_NO_SANITIZE (both referenced by the diff), and keep the GOOGLE MODIFICATION markers.",
      "For frameworks/base, apply the allowlist in the ImageInfo-taking method immediately before the DEFAULT_DECODE_HARD_LIMIT_PX check. The Android 14 diff is identical to the Android 16 one apart from a 3-line hunk offset."
     ],
     "confidence": "medium",
     "unknowns": [
      "The exact failure mode (sanitizer abort or other misbehavior) is not stated in the material; only the bulletin's DoS type and the no-sanitize attribute hint at it.",
      "How fAreaSpec Plane/Planes are parsed from the file is not shown.",
      "The body of dng_area_spec::ScaledOverlap, and which arithmetic in it overflows, is not shown.",
      "Which process runs LocalImageResolver and decodes the image is not shown.",
      "Whether a dng_sdk commit was applied on Android 14, and whether a frameworks/base commit was applied on Android 15 (only the patched-region presence is reported).",
      "Why the resolveImage(uri, context) test expects IOException while the sized-overload test expects RuntimeException is not explained by the shown code.",
      "Whether other opcode implementations in dng_misc_opcodes.cpp use the same Plane()+Planes() loop bound."
     ],
     "meta": {
      "generated": "2026-10-02",
      "author_model": "claude-fable-5-1",
      "review_model": "claude-opus-5-5",
      "review_corrections": 6,
      "note": "AI-generated from the bulletin, the fixing diffs and their code context, then checked claim by claim by a second model. Statements marked '(general platform knowledge)' are not taken from the material."
     }
    }
   }
  },
  "17": {
   "counts": {
    "announced": 0,
    "certain": 0,
    "probable": 0,
    "not_published": 0,
    "not_covered": 0,
    "awaiting": 0
   },
   "advisories": [],
   "tags": [],
   "unannounced": [],
   "coverage": {
    "n_ingested_tags": 2,
    "first_ingested_tag": "android-security-17.0.0_r1",
    "latest_ingested_tag": "android-security-17.0.0_r2",
    "window_base_tag": "android-17.0.0_r1",
    "window_start": "2026-06-16",
    "partial_tags": []
   },
   "platform_update_tags": {},
   "briefs": {}
  }
 },
 "bulletin": {
  "url": "https://source.android.com/docs/security/bulletin/2026/2026-04-01",
  "latest_version": "1.1",
  "latest_revision": {
   "version": "1.1",
   "date": "April 8, 2026",
   "notes": "Updated with AOSP links"
  },
  "revisions": [
   {
    "version": "1.0",
    "date": "April 6, 2026",
    "notes": "Bulletin published"
   },
   {
    "version": "1.1",
    "date": "April 8, 2026",
    "notes": "Updated with AOSP links"
   }
  ],
  "tracked_since": "2026-09-30",
  "changes_since_tracking": [],
  "out_of_scope_rows": {},
  "note": "changes are only visible from `tracked_since`; earlier revisions of the bulletin cannot be reconstructed. Out-of-scope rows (vendor closed-source, kernel) have no public AOSP code to resolve."
 }
}