The flaw exists in the image decoding routine of the Android operating system, where the header decoding logic can be abused to exhaust device resources. The attacker does not need elevated privileges or any interactive step – simply loading a crafted image locally triggers the denial. Affected processes may become unresponsive or terminate, leading to a service interruption for the user.

Android devices running versions 14, 15, and 16, including the QPR2 beta 1, 2, and 3 releases from Google, are impacted.

The current scoring reflects a moderate severity rating, but the likelihood of exploitation in the wild is very low, as the EPSS score is below one percent and the vulnerability is not listed in the Known Exploited Vulnerabilities catalog. Because the flaw is local and does not demand user interaction, any app that loads images may be susceptible, yet the overall operational risk remains limited to the affected device or application.