Google
Android OS 17 'Cinnamon Bun'
Android OS 17 'Cinnamon Bun'
Third-party support for the Google Android OS 17 'Cinnamon Bun': 24/7 engineers manage issues, remediate vulnerabilities, and help you maintain compliance — independent of the vendor contract.
Issue Management
24/7 engineers own your Android OS 17 'Cinnamon Bun' incidents end to end.
Vulnerability Remediation
Mitigation and patch-around guidance when the vendor no longer ships fixes.
Compliance Maintenance
Controls evidence and documentation that keep auditors satisfied.
Specifications
- product
- android
- release
- 17
- product Label
- Android OS
- release Label
- 17 'Cinnamon Bun'
- codename
- Cinnamon Bun
- lts
- latest Version
- release Date
- 2026-06-16
- maintained
- true
- source Url
- https://endoflife.date/android
OEM vs. 3rd Party Support
See how third-party support compares to the vendor contract for Android OS 17 'Cinnamon Bun' — monitoring, break/fix, vulnerability work, operations and compliance, before and after EOSL.
| Feature | OEM Support | 3rd Party Support |
|---|---|---|
| Post-EOSL Support | ||
| Break/Fix Support | Until EOSL | |
| 24/7 Monitoring | ||
| Vulnerability Scanning & Remediation | ||
| Managed Operations | ||
| Procedure & Configuration Review | ||
| Compliance & Audit Documentation | Limited | |
| Discounted Migration to Other Platforms |
Why Choose 3rd Party Support for Android OS 17 'Cinnamon Bun'?
Vulnerability Remediation
Scanning, mitigation and patch-around guidance for Android OS 17 'Cinnamon Bun' when the vendor no longer ships fixes.
Compliance Maintenance
Procedure review, controls evidence and the documentation auditors ask for — maintained continuously, not scrambled at audit time.
24/7 Expert Support
Engineers who know this release monitor, manage and fix issues around the clock — break/fix to managed operations.
Android OS 17 'Cinnamon Bun' Support: Frequently Asked Questions
Is the Google Android OS 17 'Cinnamon Bun' still supported?
Yes. The Android OS 17 'Cinnamon Bun' is currently supported by Google, and third-party support is available as an alternative — issue management, vulnerability remediation, and compliance help independent of the vendor contract.
How much does third-party support for the Android OS 17 'Cinnamon Bun' cost?
Typically 40-70% below the OEM maintenance renewal price. Exact pricing depends on quantity, service level and location — request a quote and we respond within 24 hours.
Known Vulnerabilities Affecting Android OS 17 'Cinnamon Bun'
1798 published CVEs affect the Google Android OS 17 'Cinnamon Bun', including 1255 rated critical or high severity. Our 24/7 engineers help you assess exposure, prioritize fixes and apply available patches.
| CVE | Severity | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-28615 | CRITICAL | 10.0 | Jun 17, 2026 | In Telecomm, there is a possible way to initiate an unauthorized phone call due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-28587 | CRITICAL | 10.0 | Jun 17, 2026 | In MmsSmsProvider of MmsSmsProvider.java, there is a possible way to retrieve sensitive information due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-28576 | CRITICAL | 10.0 | Jun 17, 2026 | In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-28575 | CRITICAL | 10.0 | Jun 17, 2026 | In PackageInstaller.Session#transfer of frameworks/base/services/core/java/com/android/server/pm/PackageInstallerSession.java, there is a possible memory exhaustion attack due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-0092 | CRITICAL | 10.0 | Jun 17, 2026 | In Package Manager, there is a possible device lock controller bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-0083 | CRITICAL | 10.0 | Jun 17, 2026 | In Nfc::eventCallback() of Nfc.h, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-0082 | CRITICAL | 10.0 | Jun 17, 2026 | In tryStartActivity of NfcDispatcher.java, there is a possible automatic special app access permission assignment due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-0081 | CRITICAL | 10.0 | Jun 17, 2026 | In NFC, there is a possible way to spoof an NFC event due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-0071 | CRITICAL | 10.0 | Jun 17, 2026 | In SettingsLib, there is a possible missing permission check due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-0068 | CRITICAL | 10.0 | Jun 17, 2026 | In createSessionInternal of PackageInstallerService.java, there is a possible method to remove a DPC app from a managed device without DO consent due to desync from persistence. This could lead to local escalation of privilege if a user can install a malicious app with no additional execution privileges needed. User interaction is needed for exploitation. |
| CVE-2026-0064 | CRITICAL | 10.0 | Jun 17, 2026 | In multiple places, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-0063 | CRITICAL | 10.0 | Jun 17, 2026 | In setAllowedCarriers of PhoneInterfaceManager.java, there is a possible way to disable carrier restrictions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-0124 | CRITICAL | 10.0 | Mar 10, 2026 | There is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2025-48611 | CRITICAL | 10.0 | Mar 10, 2026 | In DeviceId of DeviceId.java, there is a possible desync in persistence due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2024-47040 | CRITICAL | 10.0 | Dec 18, 2024 | There is a possible UAF due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2024-47038 | CRITICAL | 10.0 | Dec 18, 2024 | In dhd_prot_flowrings_pool_release of dhd_msgbuf.c, there is a possible outcof bounds write due to a missing bounds check. This could lead to localcescalation of privilege with no additional execution privileges needed. Usercinteraction is not needed for exploitation. |
| CVE-2018-9416 | CRITICAL | 10.0 | Dec 5, 2024 | In sg_remove_scat of scsi/sg.c, there is a possible memory corruption due to an unusual root cause. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-0126 | CRITICAL | 9.8 | Jun 16, 2026 | In WC-Radio, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-0120 | CRITICAL | 9.8 | Mar 10, 2026 | In modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-0116 | CRITICAL | 9.8 | Mar 10, 2026 | In __mfc_handle_released_buf of mfc_core_isr.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. |
Showing the 20 most severe of 1798 known CVEs.
Get Third Party SupportRelated Google Products
All Google products →Android OS 17 'Cinnamon Bun'
Save 40-70% vs OEM