A logic error within the InputDispatcher flushSensor function in Android’s input system can be exploited to cause a local denial of service. By triggering this flaw, an attacker can continuously flush sensor inputs leading to resource exhaustion or a system crash. The vulnerability does not require elevated privileges and can be executed without user interaction.

The flaw affects Android devices running Google's InputDispatcher component. No specific affected Android release versions are listed in the advisory, so any device with the vulnerable InputDispatcher code is potentially impacted.

The denial of service is local and does not expose sensitive data. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no observed exploitation yet. The likely attack vector is local execution on the device, potentially triggered by malicious code that can inject sensor events. Because no privileges are required, the risk is moderate, but an unpatched device could become unresponsive or restart as a result of repeated exploitation attempts.