The vulnerability involves an integer overflow in the parseContentType method of PduParser.java. This flaw can cause a denial of service without requiring elevated privileges or user interaction, allowing an attacker to crash the system remotely. The weakness is a classic integer overflow, corresponding to CWE‑190.

Affected systems include devices running the Android operating system. The specific versions are not enumerated in the advisory, so the issue may exist across multiple releases until the fix is applied.

The CVSS score is not disclosed, and the EPSS score is unavailable, so the baseline risk cannot be quantified precisely. The vulnerability is listed as not included in CISA's KEV catalog. Based on the context of the PduParser, which processes SMS or MMS PDUs, the likely attack vector is the delivery of a crafted message over the network, which can be sent without user interaction. Remote attackers could exploit the overflow by sending a specially crafted PDU to trigger the integer overflow and crash the relevant service.