Executive brief
Android's VoiceInteractionManagerService component handles voice interaction functionality on Android devices. A resource exhaustion vulnerability in this component can be exploited to cause a persistent denial of service, making the device unresponsive or forcing it to restart repeatedly without requiring special permissions or user interaction.
Technical details
This vulnerability is a denial of service due to resource exhaustion in the initForUserNoTracing method of VoiceInteractionManagerService.java. The vulnerable code fails to properly manage system resources, allowing an attacker with local access to exhaust resources and crash the service. The attack vector is local with no additional execution privileges required, and user interaction is not needed for exploitation. The vulnerability affects multiple Android versions (14 through 17) and patches are available in the September 2026 security update (2026-09-05 or later).
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed: Android Security Bulletin published
- 2026-09-05: patched: Security patch level 2026-09-05 or later addresses this issue