The vulnerability exists in several functions of PduParser.java where a bounds check is omitted, resulting in a possible out-of-bounds read. This flaw can cause an application or system to crash, leading to a denial of service that requires no additional privileges. The impact is confined to service availability and does not compromise confidentiality or integrity. The weakness corresponds to a bounds-checking error identified by CWE-119.

Android operating systems from Google are affected, as the flaw is in core network protocol parsing code. No specific Android release or build version is listed; affected devices should consider that any installation containing the unpatched PduParser component is vulnerable.

The denial of service can be triggered remotely and does not necessitate user interaction, making it accessible to attackers over the network. Because no EPSS score is available, the exploitation probability is uncertain, but the flaw is likely usable by automated scripts that generate malicious protocol frames. The vulnerability is not currently listed in the CISA KEV catalog, but the lack of a publicly available patch means that the risk remains until an official update is released.