The setPermissionGrantState method in DevicePolicyManagerService allows malformed input to cause an unhandled exception that crashes the system daemon. This results in a persistent denial of service locally, requiring no privilege escalation or user interaction. The underlying weakness is improper input validation, which aligns with CWE-20.

Android devices that include the DevicePolicyManagerService component with the vulnerable code. Specific version information is not disclosed, so any installation that contains this service may be impacted.

The CVSS score is 5.5 and the EPSS score is unavailable, while the vulnerability is not listed in the KEV catalog. The attack vector is local; any process on the device, including potentially malicious apps, can invoke the vulnerable method with invalid data. Because no privileges or user interaction are required, the likelihood of exploitation on a device with a compromised or misbehaving application is high. The outcome is a complete denial of service, rendering the device unusable until reboot or reinstallation of the affected component.