In multiple Android code paths a permission check was omitted, permitting any local user to trigger a denial of service without the need for elevated privileges or explicit user interaction. This flaw can cause applications or system components to become unresponsive, potentially rendering the device unusable until a reboot or patch is applied.

The vulnerability affects the Android operating system distributed by Google. No specific Android version is listed, so all releases that contain the affected code paths may be impacted.

The flaw is local only, but it does not require any special privileges, meaning any user on the device can exploit it. Because the EPSS score is unavailable and the issue is not listed in CISA KEV, the exploitation likelihood is uncertain, yet the impact of a locally usable DoS on a mobile device is high. Once exploited, the attacker can disrupt the device’s normal operation, hindering user productivity and potentially exposing the device to further attacks if services are interrupted.