In Android, the DevicePolicyManagerService has a flaw that allows an application to hide a critical system package by sending malformed input. The improper validation results in the system becoming unable to access an essential package, causing a local denial of service. Because the vulnerability operates entirely within the device, it does not grant additional execution privileges but can disable vital system functions for the user. The weakness is rooted in inadequate input validation.

The vulnerability affects Android devices managed through the DevicePolicyManagerService. The specific Android versions or build identifiers are not listed in the provided data, so all devices running affected Android releases are potentially vulnerable.

The attack can be carried out by a malicious or compromised local app without any user interaction. No remote execution or access is required. The CVSS score is 5.5, and the EPSS score is unavailable; the vulnerability is not listed in CISA's KEV catalog. Consequently, while the exact exploitation probability is unknown, local privilege escalation is not needed, making it a straightforward local denial of service that could impact system availability.