CVE-2026-0005
published 2026-03-02CVE-2026-0005: In onServiceDisconnected of KeyguardServiceDelegate.java, there is a possible partial bypass of app pinning allowing limited interaction with other apps…
PriorityP428medium6.2CVSS 3.1
AVLACLPRNUINSUCHINAN
EPSS
0.13%
2.5th percentile
In onServiceDisconnected of KeyguardServiceDelegate.java, there is a possible partial bypass of app pinning allowing limited interaction with other apps without knowing the LSKF due to a missing permission check. This could lead to local information disclosure where the extent of interaction and impact is app-dependent with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| platform | frameworks_base | >= 14:0 < 14:2026-03-01 | 14:2026-03-01 |
| platform | frameworks_base | >= 15:0 < 15:2026-03-01 | 15:2026-03-01 |
| platform | frameworks_base | >= 16-qpr2-next:0 < 16-qpr2-next:2026-03-01 | 16-qpr2-next:2026-03-01 |
| platform | frameworks_base | >= 16:0 < 16:2026-03-01 | 16:2026-03-01 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-cgp5-crpx-mgqw: In onServiceDisconnected of KeyguardServiceDelegate
ghsa_unreviewed·2026-03-02
CVE-2026-0005 [MEDIUM] CWE-200 GHSA-cgp5-crpx-mgqw: In onServiceDisconnected of KeyguardServiceDelegate
In onServiceDisconnected of KeyguardServiceDelegate.java, there is a possible partial bypass of app pinning allowing limited interaction with other apps without knowing the LSKF due to a missing permission check. This could lead to local information disclosure where the extent of interaction and impact is app-dependent with no additional execution privileges needed. User interaction is not needed for exploitation.
OSV
CVE-2026-0005: In onServiceDisconnected of KeyguardServiceDelegate
osv·2026-03-01
CVE-2026-0005 CVE-2026-0005: In onServiceDisconnected of KeyguardServiceDelegate
In onServiceDisconnected of KeyguardServiceDelegate.java, there is a possible partial bypass of app pinning allowing limited interaction with other apps without knowing the LSKF due to a missing permission check. This could lead to local information disclosure where the extent of interaction and impact is app-dependent with no additional execution privileges needed. User interaction is not needed for exploitation.
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-0005 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.2
CVE-2026-0005 [MEDIUM] CVE-2026-0005 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-0005 :
NixOS vulnerability analysis and mitigation
In onServiceDisconnected of KeyguardServiceDelegate.java, there is a possible partial bypass of app pinning allowing limited interaction with other apps without knowing the LSKF due to a missing permission check. This could lead to local information disclosure where the extent of interaction and impact is app-dependent with no additional execution privileges needed. User interaction is not needed for exploitation.
Source : NVD
## 6.2
Score
Published March 2, 2026
Severity MEDIUM
CNA Score 6.2
Affected Technologies
NixOS
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 0.1
Exploitation Probability (EPSS) N/A
Affected packag
Bugzilla
CVE-2026-109448 postgresql-odbc: postgresql-odbc: Denial of Service via integer wraparound in SQLBindParameter
bugzilla·2026-10-12·CVSS 5.9
CVE-2026-109448 [MEDIUM] CVE-2026-109448 postgresql-odbc: postgresql-odbc: Denial of Service via integer wraparound in SQLBindParameter
CVE-2026-109448 postgresql-odbc: postgresql-odbc: Denial of Service via integer wraparound in SQLBindParameter
Integer wraparound in psqlODBC SQLBindParameter allows an application, or an attacker who controls how many parameters the application binds on one statement, to corrupt heap memory. psqlODBC stores the binding count in a signed 16-bit field. Binding parameter number 32768 wraps that count to -32768. Binding parameter 32769 then writes about 2.5 MB of zeros starting 1.25 MB before the binding array, which crashes the application or leaves it running on a corrupted heap. Applications that build parameter lists from untrusted input, such as an IN (?, ?, ...) list, are exposed. Versions before psqlODBC 18.00.0005 are affected.
2026-03-02
Published