Technical impact
An integer overflow can occur in several UBSan runtime functions when handling input data, causing the program to crash. The crash can be triggered remotely without the need for elevated privileges or user interaction, resulting in a denial‑of‑service condition that affects the entire Android system. The flaw is a classic Integer Overflow or Wraparound (CWE‑190) vulnerability.
Affected Systems
The vulnerability impacts devices that run Google’s Android operating system. Specific affected versions are not listed; therefore, any build that includes the UBSan runtime code referenced in the description may be vulnerable until a patch is applied.
Risk and Exploitability
Because the defect leads only to a crash and does not allow code execution or data exfiltration, the immediate risk is a denial‑of‑service. The CVSS score of 6.5 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not yet in the CISA KEV catalog, indicating no publicly known exploits. An attacker can send crafted input over a network or service that processes untrusted data, overflowing an integer in UBSan handlers and forcing the device to reboot or stop functioning. The attack does not require privileged access or user interaction, so it can be launched against any exposed component.
