The vulnerability exists in the isPackageNullOrSystem method of Android's AppOpsService.java. Improper input validation can trigger a persistent denial of service by causing the service to crash or become unresponsive. The flaw requires no elevated privileges or user interaction, meaning a local attacker with access to the device can exploit the flaw to halt or degrade the operation of the affected service.

The flaw affects Android devices running versions 14.0, 15.0, 16.0, and the 16.0 beta releases 1 through 3. Any device running these builds without the corresponding security update is vulnerable.

The CVSS base score is 6.2, indicating moderate severity. The EPSS score is below 1 %, and the flaw is not listed in the CISA KEV catalog. Because the exploitation requires only local access and no privileges, a malicious application could exploit the flaw by sending crafted requests to the AppOpsService. The lack of user interaction lowers the barrier for exploitation, but an attacker would still need entry into the device to trigger the denial of service.