The vulnerability exists in the isSameApp method of NotificationManagerService.java and can cause persistent resource exhaustion, leading to a local denial of service. Because the attack requires only local execution and no additional privileges, any user on the device can potentially exploit it. The impact is downtime of the notification subsystem and disruption of application visibility and user experience.

The flaw is present on systems running Google’s Android operating system. No specific versions are listed in the CVE data, so all current Android releases may be affected until a patch is issued.

The CVSS score of 5.5 and the EPSS score is unavailable, indicating the vulnerability has a moderate severity yet the likelihood of exploitation remains uncertain. Because the flaw is local and requires no additional privileges, an attacker with physical or local access could trigger it by interacting with notification handling, potentially leading to prolonged service disruption. This vulnerability is not yet listed in the CISA KEV catalog, but the local denial of service could negatively impact device usability.