The vulnerability arises from a missing bounds check in multiple functions of the Android PduParser.java file. Attackers can craft malformed Protocol Data Units that trigger the unchecked reads or writes, causing the system to stall or crash. This results in a persistent denial of service. Because the flaw does not require elevated privileges or user interaction, it can be exploited remotely by any actor capable of delivering the malformed packet to a vulnerable device.

Google's Android operating system includes the affected PduParser component. The vulnerability is present in any product version that contains the unpatched PduParser.java implementation. No specific version information is provided, so all versions that have been released prior to the appropriate patch should be considered at risk.

The CVSS score is 7.5, indicating high severity. The vulnerability is not listed in the CISA KEV catalog, and the absence of a required privilege escalation or user interaction suggests that the risk is non‑negligible. The missing bounds check allows attackers to send malformed PDUs that cause persistent crashes or hangs, leading to service unavailability. Because the flaw can be exploited remotely by any actor capable of delivering the malformed packet, the potential impact spans all affected Android devices.