Technical impact
A flaw in multiple functions of ubsan_throwing_runtime.cpp triggers an integer overflow, which can cause a persistent denial of service and elevate local privileges. The overflow can be exploited without granting additional execution privileges, allowing an attacker with local access to gain higher authority over the device. This kind of vulnerability undermines both the integrity and availability of the affected system.
Affected Systems
The vulnerability is reported for Google Android. Specific Android version details are not provided in the advisory, so all current releases may be susceptible until an official fix is released.
Risk and Exploitability
The exploit requires only local access and does not need user interaction, making it potentially easier to activate. With a CVSS score of 5.5, the vulnerability is considered medium severity. Although it is not listed in CISA’s KEV catalog, the possibility of local privilege escalation combined with denial of service indicates a significant risk to affected devices. Attackers could leverage the overflow to disrupt services or gain elevated control over the device without further privileges.
