The vulnerability is in the legacy.rs deserialization routine of Android, wherein a bounds check is missing during processing of legacy data structures. An attacker can supply a crafted input that violates expected bounds, causing the deserializer to allocate excessive memory or crash. This results in a local denial‑of‑service condition without the need for elevated privileges or additional execution rights. Because the flaw is executed during normal deserialization, the impact is loss of availability for the affected instance or device.

Google Android devices are affected. No specific device models or Android API levels were listed in the advisory. The flaw resides in the legacy.rs component of the Android runtime and could manifest in any application or system process that triggers this deserialization path.

The CVSS score is not provided and the EPSS score is unavailable, indicating that the vendor has not yet quantified risk. The flaw is not listed in CISA’s KEV catalog. Exploitation only requires that a malicious payload be processed by the vulnerable deserializer; user interaction is not required. Because it is a local denial of service, attackers need only to be able to influence the deserialization input, which might occur through application installation, network messages, or other data sources.