Android DevicePolicyManagerService EUVD-2026-92612

Exploitation requires local execution on the device within a privileged context able to call DevicePolicyManager.setPermissionGrantState - in practice an app holding device-owner or profile-owner (device policy controller) rights, consistent with CVSS PR:L. The attacker must supply malformed input to this specific API path, where missing input validation (CWE-20) allows corrupted policy/permission state to be persisted. Limiting factors: no remote vector (AV:L, attacker needs on-device code execution), the required privilege level excludes ordinary unprivileged apps, and impact is restricted to availability (C:N/I:N) - no data disclosure or integrity compromise. The denial of service is persistent, so recovery may require administrative remediation rather than a simple restart.

All signals converge on a genuine-but-moderate local availability issue, not a top-tier emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) describes a locally exploitable flaw requiring some privilege (PR:L), no user interaction, with impact confined to availability (A:H) and no confidentiality or integrity effect. CISA's SSVC decision framework corroborates the lower-urgency reading: Exploitation=none (no observed or public exploitation), Automatable=no, Technical Impact=partial. There is no CISA KEV listing and no EPSS score supplied in the input, so quantitative exploitation probability is unavailable. No POC is referenced. The signals are mutually consistent - a DoS-only bug reachable only locally with privileges and no active exploitation - so there is no high-CVSS-but-hidden-criticality or conflicting-signal problem here; conversely it is not merely theoretical, since the Android Security Bulletin confirms it as a real, patched defect. Note the described impact is a PERSISTENT denial of service (survives across sessions/reboots), which raises operational severity somewhat above a transient crash even though the base score remains Medium.

A malicious or compromised privileged app (e.g. one acting as or abusing a device policy controller) invokes setPermissionGrantState with malformed input that is not properly validated, corrupting persisted device-policy/permission state. Because the bad state is written to storage, the resulting denial of service persists across reboots and cannot be cleared by simply restarting. No public exploit code is identified, and exploitation requires local code execution with policy-management privileges rather than remote access.