Android EUVD-2026-115580

Exploitation requires local access to the device - a malicious or compromised application able to deliver crafted input to the parseKnownActivityEmbeddingCerts code path in ParsingUtils.java; the CVSS vector is AV:L, so there is no remote or network-triggerable path. Per the description no additional execution privileges (PR:N) and no user interaction (UI:N) are needed once that local input reaches the parser, and the result is a permanent (persistent) denial of service affecting availability only. The limiting factor is the local vector itself: the attacker must already be running code or supplying input on the device. The exact malformed-input structure and whether a particular feature or configuration is required are not described in the available sources. Affected builds are Android 14 through 17 (including 16-qpr2); devices on the 2026-11-01 patch level or later are fixed.

This is a moderate-severity local availability flaw (CVSS 6.2, CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) in Android's ParsingUtils.java (parseKnownActivityEmbeddingCerts). The signals are internally consistent and point to a low operational priority despite the broad platform footprint: the attack vector is local (AV:L), not network, so there is no remote mass-exploitation path; impact is confined to availability (A:H, a permanent/persistent DoS) with no confidentiality or integrity loss. EPSS is very low at 0.11% (1st percentile), the CVE is NOT on the CISA KEV list, and no public exploit or PoC reference is present in the supplied data - so there is no evidence of active exploitation. The vuln.today decision label is 'this_month', which aligns with a routine, scheduled Android patch rather than an emergency. The one nuance worth stating: PR:N indicates no privileges are required, but because AV:L is local, exploitation still presupposes the attacker can get code/input onto the device (e.g., a malicious or compromised app), which materially limits real-world reach. Overall this is a genuine but non-urgent fix: high CVSS-for-a-DoS, low real-world risk, patch on the normal monthly Android cadence.

A malicious or compromised application installed on the device supplies crafted/malformed input that reaches the parseKnownActivityEmbeddingCerts routine, where improper input validation triggers a permanent denial of service. No user interaction and no additional execution privileges are required. No public exploit or PoC has been identified at the time of analysis.