Technical impact
In Android, several functions in the ubsan_throwing_runtime.cpp module perform unchecked arithmetic that can overflow, causing the operating system to crash. The vulnerability does not require any special privileges or user interaction; an attacker can trigger the overflow remotely, resulting in a denial of service to any affected device.
Affected Systems
The flaw exists in the Android operating system within the ubsan_throwing_runtime.cpp code base. The vendor, Google, does not list affected version ranges in this advisory, so any Android build that contains the unpatched runtime functions could be impacted.
Risk and Exploitability
The attack vector is remote and automated, with no user interaction needed, meaning an attacker could deliver a crafted payload to an Android device to induce the crash. The CVSS score is 6.5 and the EPSS score is not available; the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation. However, the inherent impact of a complete system crash is significant and should be treated with high priority.
