Android Trusty EUVD-2026-115414

Exploitation requires the attacker to execute code locally on the device (e.g., via an installed or compromised application) and to issue a connection request processed by handleConnectInternal in the Trusty RPC server (RpcServerTrusty.cpp). No authentication (PR:N) and no user interaction (UI:N) are required once local execution is achieved. Limiting factors: the attack is local-only (AV:L) - it cannot be performed remotely - and is confirmed only against Android 16-qpr2 and Android 17 builds; impact is restricted to availability (service crash/hang), with no confidentiality or integrity effect and no privilege gain.

This is a moderate-severity local denial-of-service issue (CVSS 6.2, CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) in Android's Trusty IPC layer (RpcServerTrusty.cpp). The signals are consistent and point to limited real-world urgency: the attack vector is local (AV:L), so an attacker must already be able to run code on the device; impact is availability-only (C:N/I:N/A:H) with no code execution or data exposure. EPSS is very low at 0.12% (2nd percentile), there is no CISA KEV listing, and no public exploit is referenced - all of which agree that widespread opportunistic exploitation is unlikely. The vuln.today decision label is 'this_month,' indicating routine prioritization rather than emergency patching, which aligns with the low EPSS and absence of active exploitation. This is a legitimate fix-in-normal-cycle issue, not a high-CVSS-but-overstated emergency; the main caveat is that the CVSS PR:N (no privileges) sits alongside the fact that AV:L exploitation inherently requires the attacker to already have local execution context on the device, so the practical barrier is higher than PR:N alone suggests.

A malicious or compromised local application on an affected Android device issues a crafted connection request handled by handleConnectInternal in the Trusty RPC server, triggering a logic error that crashes or hangs the service and denies availability. No user interaction and no additional privileges are required, but the attacker must already be running code locally on the device. No public exploit code is referenced in the available sources.