Google Android EUVD-2026-115384

Exploitation requires local access to the device - the attacker must already be executing code locally (AV:L), typically via a malicious or compromised application, since there is no network-reachable entry point. Once local code runs, no privileges (PR:N) and no user interaction (UI:N) are required to trigger the flaw by supplying crafted input to one of several code paths lacking proper input validation (CWE-20), resulting in a persistent denial of service. The primary limiting factor is the local attack vector: remote exploitation is not possible, so an attacker must first achieve a foothold on the device (e.g., convince a user to install a malicious app). The description does not condition the flaw on any non-default setting or special deployment mode, so default configurations of the affected Android 14-17 versions appear exposed.

This is a moderate-severity, local-only availability issue (CVSS 3.1 6.2, AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) affecting Google Android 14 through 17. All exploitation signals point to a low real-world priority rather than an urgent crisis: the vector is LOCAL (AV:L), meaning an attacker must already be running code on the device (e.g., a malicious or compromised app), which sharply limits reach compared to a network-exploitable flaw. EPSS is very low at 0.11% (1st percentile), there is no CISA KEV listing (not confirmed actively exploited), and no public exploit was identified. The impact is confined to availability (A:H, persistent denial of service) with zero confidentiality or integrity impact (C:N/I:N). The vuln.today decision label is 'this_month', consistent with a patch-on-normal-cadence item rather than act_now/emergency. The one notable aggravator is the persistent nature of the DoS and that no privileges (PR:N) or user interaction (UI:N) are required once local code execution exists, so any unprivileged local app could trigger it. Net: a legitimate but non-emergency fix - address it in the normal monthly Android patch cycle; it is not a high-CVSS-but-overblown issue so much as a genuinely bounded local availability bug.

A malicious or compromised unprivileged application installed on an Android device supplies crafted input to one of several vulnerable code paths that perform improper input validation, triggering a persistent denial of service that degrades or disables device functionality until remediated. Because the vector is local (AV:L), the attacker must first have code running on the device, but no elevated privileges or user interaction are required thereafter. No public exploit code was identified at time of analysis.