The vulnerability originates in SearchRequestDatabaseUtil.java of the Android operating system, where certain functions allow an attacker to inject arbitrary SQL statements into database queries. This unsanitized input can retrieve or manipulate protected data, and in worst‑case scenarios results in a local denial of service. The flaw does not grant any execute privileges and does not require user interaction, meaning any app or local user can trigger the issue.

Affected systems are devices running Google's Android operating system. The CVE does not specify particular versions or builds, so all Android releases containing the vulnerable SearchRequestDatabaseUtil code are potentially exposed until an official patch is provided.

The denial‑of‑service impact is local, and the attacker’s ability to exploit it relies solely on the compromised device’s local context. The EPSS score is unavailable, and the vulnerability is not yet listed in CISA's KEV catalog. Nevertheless, because the flaw allows direct SQL injection without privilege escalation, it poses a clear risk to device stability and should be treated as a medium‑to‑high risk pending timely updates.