EUVD-2026-33774
GHSA-xr2g-57fm-4f25
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local low-privilege shell or install malicious app
-
DeliveryInvoke vulnerable ubsan_throwing_runtime.cpp function with crafted input
-
ExploitTrigger integer overflow in UBSan runtime arithmetic
-
ExecutionCorrupt runtime internal state
-
ImpactCause persistent denial of service or escalate local privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local access to the affected Android device with at least low-level privileges, as confirmed by the CVSS vector (AV:L/PR:L). No user interaction is required (UI:N per CVSS). The vulnerability is present in multiple functions within ubsan_throwing_runtime.cpp, a component of the UBSan runtime that is part of the Android system. Exploitation is limited by the local-only attack vector - no network-reachable path is indicated by any available data. Scope is further constrained to Android 14, 15, 16-qpr2, and 16 specifically; versions outside this set are not listed as affected. No special non-default system configuration is identified as a prerequisite in the available description. The low-privilege requirement (PR:L) means a malicious app or shell user without elevated rights is sufficient, but physical device access or an installed application vector is still necessary. |
| Impact | The CVSS 3.1 base score of 5.5 (Medium) reflects a local attack vector (AV:L), low complexity (AC:L), and low privilege requirements (PR:L), with no user interaction needed (UI:N) and unchanged scope (S:U). The CVSS impact subscores record only Availability:High with Confidentiality:None and Integrity:None - however, the CVE description explicitly states the vulnerability 'could lead to local escalation of privilege,' implying Integrity or Confidentiality impact that is not captured in the current CVSS scoring. This discrepancy between the CVSS impact vector and the described privilege escalation outcome is a notable inconsistency that should be verified against Google's June 2026 security bulletin. No EPSS probability data was provided, and this CVE does not appear in the CISA KEV catalog. No public exploit has been identified at time of analysis. The characterization of the DoS as 'persistent' (rather than transient) elevates practical device impact beyond a simple crash. Overall real-world risk is moderate and strictly bounded to attackers already possessing local low-privilege access. |
| Exploit ScenarioDerived | A local attacker with a low-privileged shell on an affected Android device - for example, via an installed malicious application granted minimal permissions or via physical ADB access - triggers one or more vulnerable functions in ubsan_throwing_runtime.cpp with crafted inputs that induce an integer overflow in the runtime sanitizer. The overflow corrupts internal runtime state, resulting in persistent denial of service that may render the device or a critical process unresponsive until reboot, and may additionally enable local privilege escalation depending on exploitable state conditions. No public proof-of-concept code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 02, 2026
Persistent denial of service and local privilege escalation in Google Android's UBSan runtime component affect Android 14, 15, 16-qpr2, and 16, stemming from an integer overflow in multiple functions of ubsan_throwing_runtime.cpp. An authenticated local attacker with low-level privileges and no required user interaction can exploit this overflow to trigger persistent availability loss and, per the description, possible privilege escalation. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
RemediationAI
Apply patches included in Google's Android Security Bulletin for 2026-06-01, available at https://source.android.com/docs/security/bulletin/2026/2026-06-01. OEM and carrier distributions should incorporate these patches into over-the-air updates; device owners should apply pending system updates promptly. Note that an exact patched build version number was not independently confirmed from the available reference data - consult the bulletin directly for specific patch level identifiers. If immediate patching is not feasible, restricting untrusted local code execution, enforcing strict app sandboxing policies, and limiting interactive shell access to the device reduce exposure, though none of these controls eliminate the underlying vulnerability. Enterprise MDM policies enforcing minimum Android security patch levels can serve as a compensating detection and enforcement control while OEM rollouts are pending.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in ubsan_throwing_runtime.cpp, a component of Android's Undefined Behavior Sanitizer (UBSan) runtime - a compiler-instrumented safety layer that detects and handles undefined behavior such as out-of-bounds accesses and signed integer overflows at runtime. CWE-190 (Integer Overflow or Wraparound) describes the root cause: arithmetic operations on integer values exceed the representable range of the data type, causing the result to wrap around to an unintended value. In the context of a runtime support library managing exception dispatch and sanitizer signal handling, such overflows can corrupt internal state or size calculations governing memory operations, potentially enabling both persistent denial of service and privilege escalation. The affected CPE (cpe:2.3:a:google:android:*:*:*:*:*:*:*:*) spans multiple Android release branches as enumerated by EUVD-2026-33774.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (google_android) · only source for this CVE.
CVSS VectorVendor: google_android
Lifecycle Timeline
3DescriptionCVE.org
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB