Android DevicePolicyManagerService CVE-2026-59008

Exploitation requires local access to the device (AV:L) - code running on the device, such as an installed or compromised app, that can invoke the setApplicationRestrictions method in DevicePolicyManagerService; no user interaction is required (UI:N) and the CVSS marks no privileges required (PR:N), though in practice setApplicationRestrictions is a Device Policy Manager operation typically reserved for a device/profile owner or an app holding the corresponding management permission, which would meaningfully limit who can reach the vulnerable path. The flaw is limited to affected builds Android 16-qpr2 and Android 17; it cannot be triggered remotely and yields only denial of service (A:H), no confidentiality or integrity impact.

This is a moderate-severity local availability issue, not an urgent priority despite its listing. The supplied CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 6.2) describes a local attack vector with low complexity, no privileges, and no user interaction, affecting availability only (denial of service) with no confidentiality or integrity impact. The EPSS score is very low at 0.11% (1st percentile), indicating negligible modeled probability of exploitation in the near term. There is no CISA KEV listing and no public exploit reference in the input, so exploitation status is: no public exploit identified at time of analysis. The vuln.today decision label is 'this_month', consistent with a patch-on-normal-cadence item rather than an emergency. One tension worth flagging: the CVSS marks PR:N (no privileges), but setApplicationRestrictions is a Device Policy Manager operation normally callable only by a device/profile owner or an app holding the relevant management role - if a privilege prerequisite does apply in practice, real-world exploitability is narrower than PR:N implies; this should be verified against the Android bulletin. Net: a legitimate local DoS to patch on schedule, not a high-real-risk, actively exploited threat.

A malicious or compromised local app on an affected Android device invokes setApplicationRestrictions in a way that triggers resource exhaustion in DevicePolicyManagerService, causing a denial of service on the device with no user interaction required. The impact is limited to availability; no code execution, data disclosure, or privilege gain results. No public exploit code is identified in the available sources.