The flaw resides in the applySimpleFieldMaxSize method of DataRowHandler.java, where an attacker can insert a contact name that exceeds normal limits because the input is not properly validated. This abuse may cause the device to consume excessive memory, trigger application crashes, or otherwise make the contacts subsystem unavailable, resulting in a local denial of service. The weakness is a form of improper input validation that enables uncontrolled resource consumption, aligning with CWE-20.

Android devices supplied or updated by Google that include the vulnerable DataRowHandler component. The public advisory does not list specific version numbers, but any device running the affected component may be vulnerable.

The CVSS score of 5.5 indicates a moderate severity. EPSS data is not available, but the exploit does not require special privileges or user interaction beyond adding a contact. The attack vector is local; therefore, the network security risk is low. However, the impact on device availability can be significant if large contacts are created. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation to date.