Description
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible UBSan failure due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Published: 2026-06-01
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability arises from an integer overflow in multiple functions of ubsan_throwing_runtime.cpp, potentially causing an UBSan failure. This flaw can be triggered remotely and results in a denial-of-service condition without requiring elevated privileges or user interaction. The impact is an interruption of services that rely on the affected functions, affecting the availability of the system.

Affected Systems

The affected product is Google Android. No specific version information is provided, so all currently supported Android releases that include the vulnerable UBSan implementation are potentially impacted until a patch is applied.

Risk and Exploitability

The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating that publicly known exploitation data is scarce. Nevertheless, the nature of the flaw grants remote attackers the ability to crash the system, which is a moderate severity outcome with a CVSS score of 6.5. The lack of required privileges and user interaction lowers the barrier to exploitation, suggesting that the risk remains significant while a vendor fix is pending.

Generated by OpenCVE AI on June 2, 2026 at 01:26 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Android security patches from Google.
  • Monitor the device for abnormal CPU or memory usage that may indicate a denial‑of‑service attack.
  • Consult the Google Android Security Bulletin for specific update details and guidance.

Generated by OpenCVE AI on June 2, 2026 at 01:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 02 Jun 2026 19:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*
cpe:2.3:o:google:android:16.0:qpr2_beta_1:*:*:*:*:*:*
cpe:2.3:o:google:android:16.0:qpr2_beta_2:*:*:*:*:*:*
cpe:2.3:o:google:android:16.0:qpr2_beta_3:*:*:*:*:*:*

Tue, 02 Jun 2026 01:45:00 +0000

Type Values Removed Values Added
Title Integer Overflow in Android UBSan Leads to Remote Denial of Service

Tue, 02 Jun 2026 00:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-190
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Mon, 01 Jun 2026 23:15:00 +0000

Type Values Removed Values Added
Title Integer Overflow in Android UBSan Leads to Remote Denial of Service
First Time appeared Google
Google android
Weaknesses CWE-680
Vendors & Products Google
Google android

Mon, 01 Jun 2026 21:45:00 +0000

Type Values Removed Values Added
Description In multiple functions of ubsan_throwing_runtime.cpp, there is a possible UBSan failure due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
References

cve-icon MITRE

Status: PUBLISHED

Assigner: google_android

Published:

Updated: 2026-06-01T23:38:48.216Z

Reserved: 2025-10-15T15:39:30.125Z

Link: CVE-2026-0041

cve-icon Vulnrichment

Updated: 2026-06-01T23:37:26.552Z

cve-icon NVD

Status : Analyzed

Published: 2026-06-01T22:16:19.810

Modified: 2026-06-02T18:45:07.303

Link: CVE-2026-0041

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-02T01:30:26Z

Weaknesses