The vulnerability resides in the loadDescription method of DeviceAdminAdd.java and allows an attacker to induce a local denial of service through improper input validation. The flaw requires no elevated privileges and does not depend on user interaction, meaning it can be triggered by any local process that supplies crafted input to the affected component. The resulting denial is limited to a crash of the Android device administration service, causing interruption of device administration functions until a restart occurs.

The issue affects Android devices running the version of the system that contains DeviceAdminAdd.java. No specific version ranges are listed in the CVE data, so all releases that include the vulnerable code path are potentially impacted. Google:Android is the vendor identified.

Because the attacker only needs local access and no additional privileges, the risk for deployed devices managed via device administration is moderate. The EPSS score is unavailable, and the vulnerability is not listed in CISA KEV, suggesting it has not yet been widely exploited. However, an automated local exploit could cause repeated crashes, potentially used to trigger cascading failures in a fleet of managed devices.