A logic error in the transfer method of PackageInstaller.Session can cause uncontrolled memory consumption, enabling a local denial‑of‑service attack without any user interaction or additional privileges. The flaw is rated with a CVSS score of 10, indicating critical severity, and the EPSS score is less than 1%, showing very low expected exploitation. The vulnerability is not listed in the CISA KEV catalog, limiting known exploitation records at this time.

The affected product is Android, as provided by Google, specifically the PackageInstaller component within frameworks/base services core. The exact version range is not specified, but the reference to the Android 17 security bulletin suggests that devices running that release and later may be impacted.

The weakness falls under resource exhaustion (CWE‑400). An attacker only needs local access to the device or ability to invoke the vulnerable method; no elevated privileges are required. Because exploitation requires local interaction and the EPSS score is below 1%, the likelihood of a real‑world attack is low, but the impact of a successful denial‑of‑service could be significant for end‑users, potentially disrupting application installation and device functionality.