Executive brief
A vulnerability in the Android operating system's runtime environment could allow a remote attacker to crash a device. This occurs due to a mathematical error in how the system handles certain internal checks, leading to a denial of service. An exploit can be triggered over a network without any user interaction or special permissions, potentially disrupting business operations or emergency communications.
Technical details
An integer overflow vulnerability exists within multiple functions of 'ubsan_throwing_runtime.cpp' in the Android System component. The flaw is triggered when the Undefined Behavior Sanitizer (UBSan) runtime encounters specific conditions that lead to an overflow, resulting in a runtime failure. This is reachable remotely and requires no prior authentication or user interaction. Successful exploitation allows an attacker to cause a permanent or temporary denial of service (DoS) on the affected device. The issue is addressed in the June 2026 Android Security Bulletin with a patch level of 2026-06-05 or later.
Affected products
- Google Android 14, 15, 16, 16-qpr2
Timeline
- 2026-06-01: advisory: Published in the June 2026 Android Security Bulletin
- 2026-06-01: disclosed: CVE-2026-0041 published to NVD