CVE-2026-107041

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-107041", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-11-02T15:23:49.410Z", "dateReserved": "2026-10-07T00:00:00.000Z", "datePublished": "2026-10-29T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-29T15:48:59.443Z"}, "descriptions": [{"lang": "en", "value": "Insecure permissions in the FeatureActionActivity component of Oasis Feng Island versionCode 51801 allows unauthorized attackers to arbitrarily force a freeze in the device, leading to a Denial of Service (DoS)."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://f-droid.org/packages/com.oasisfeng.island.fdroid/"}, {"url": "https://github.com/oasisfeng/island"}, {"url": "https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107041.md"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-926", "lang": "en", "description": "CWE-926 Improper Export of Android Application Components"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-02T15:23:22.252999Z", "id": "CVE-2026-107041", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T15:23:49.410Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-107041", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-02T15:23:22.252999Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-926", "description": "CWE-926 Improper Export of Android Application Components"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T15:22:23.736Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://f-droid.org/packages/com.oasisfeng.island.fdroid/"}, {"url": "https://github.com/oasisfeng/island"}, {"url": "https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107041.md"}], "descriptions": [{"lang": "en", "value": "Insecure permissions in the FeatureActionActivity component of Oasis Feng Island versionCode 51801 allows unauthorized attackers to arbitrarily force a freeze in the device, leading to a Denial of Service (DoS)."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-29T15:48:59.443Z"}}}, "cveMetadata": {"cveId": "CVE-2026-107041", "state": "PUBLISHED", "dateUpdated": "2026-11-02T15:23:49.410Z", "dateReserved": "2026-10-07T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-10-29T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Insecure permissions in the FeatureActionActivity component of Oasis Feng Island versionCode 51801 allows unauthorized attackers to arbitrarily force a freeze in the device, leading to a Denial of Service (DoS)."}], "id": "CVE-2026-107041", "lastModified": "2026-11-02T16:17:26.117", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-107041", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-02T15:23:22.252999Z", "version": "2.0.3"}}]}, "published": "2026-10-29T16:17:49.937", "references": [{"source": "cve@mitre.org", "url": "https://f-droid.org/packages/com.oasisfeng.island.fdroid/"}, {"source": "cve@mitre.org", "url": "https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107041.md"}, {"source": "cve@mitre.org", "url": "https://github.com/oasisfeng/island"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-926"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "island: Island: Denial of Service via insecure permissions in FeatureActionActivity", "id": "2563492", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563492"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-749", "details": ["Insecure permissions in the FeatureActionActivity component of Oasis Feng Island versionCode 51801 allows unauthorized attackers to arbitrarily force a freeze in the device, leading to a Denial of Service (DoS).", "A flaw was found in Island. Insecure permission controls in the FeatureActionActivity component allow an unauthorized attacker to arbitrarily force the device to freeze. This vulnerability leads to a Denial of Service (DoS), rendering the device unresponsive."], "name": "CVE-2026-107041", "public_date": "2026-10-29T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-107041\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-107041\nhttps://f-droid.org/packages/com.oasisfeng.island.fdroid/\nhttps://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107041.md\nhttps://github.com/oasisfeng/island"], "statement": "This vulnerability has been rated as having a Moderate impact because an unprivileged local attacker can trigger a device freeze leading to denial of service, though it does not compromise data confidentiality or integrity. Oasis Feng Island is an application designed exclusively for the Android mobile operating system and is not distributed or supported in any Red Hat enterprise offerings. Consequently, Red Hat products are not affected by this flaw.", "threat_severity": "Moderate"}

{"created": "2026-10-29T18:15:14.995971+00:00", "updated": "2026-11-06T02:15:18.145962+00:00", "vendors": []}