The vulnerability in Android’s DevicePolicyManagerService.java allows an application to invoke setApplicationRestrictions without any additional privileges, potentially exhausting device resources and causing the device to become unresponsive. The impact is a local denial of service; no user interaction is required, and the attacker does not need elevated privileges to succeed.

The affected vendor is Google, product Android. Versions of the operating system that are prior to the 2026‑11‑01 security patch are vulnerable. No specific minor release numbers are listed in the advisory, so any Android build that contains the unpatched DevicePolicyManagerService code is at risk.

The risk is driven by the alarmingly simple attack path: any app that has access to the DevicePolicyManager API can trigger the resource exhaustion. The EPSS score is unavailable, and the vulnerability is not in the CISA KEV catalog, suggesting limited known exploitation in the wild. Nonetheless, the lack of need for user interaction or elevated privileges means that an attacker could initiate the denial of service from within a compromised or malicious app, impacting device availability.