CVE-2026-0040: Android ubsan_throwing_runtime Integer Overflow DoS Vulnerability

Technical summary

The vulnerability stems from an integer overflow condition in ubsan_throwing_runtime.cpp, a component of Android's undefined behavior sanitizer runtime. Integer overflows occur when arithmetic operations produce values exceeding the maximum representable size for their data type, potentially wrapping to unexpected values. In this case, multiple functions fail to validate or prevent such overflows, allowing an authenticated network attacker to trigger the overflow and cause an abnormal termination of the affected process. The vulnerability is classified under CWE-190 (Integer Overflow or Wraparound).

Business impact

Organizations deploying affected Android devices face availability disruptions from repeated or sustained denial-of-service attacks. For enterprise Android deployments—including managed mobile devices, Android-based IoT systems, and enterprise applications running on Android—an attacker with valid credentials can disrupt service without needing to elevate privileges or manipulate users. This creates operational risk, particularly for organizations relying on Android for mission-critical or customer-facing systems. Reputational impact and support costs may follow if availability incidents occur.

Affected systems

Google Android is the confirmed affected vendor and product line. The vulnerability resides in ubsan_throwing_runtime.cpp, a foundational runtime component. Specific Android versions, patch levels, and device models are not detailed in the vulnerability record; organizations must cross-reference the official Google Android security bulletin and their device inventory to determine exact exposure.

Exploitability

This vulnerability has a CVSS 3.1 score of 6.5 (MEDIUM) with a network attack vector, low complexity, and requirement for prior authentication. The attacker does not need elevated privileges and no user interaction is required, lowering the barrier to exploitation. However, the need for valid credentials—even low-privileged ones—prevents unauthenticated remote exploitation. The vulnerability is not yet flagged for active exploitation in the wild (KEV status: not listed). Organizations should monitor for proof-of-concept releases and real-world attack reports as the vulnerability matures.

Remediation

Google will issue security patches addressing the integer overflow in ubsan_throwing_runtime.cpp. Patching is the primary mitigation. Organizations should obtain the latest Android security update for their devices and deploy it on a prioritized basis. Until patches are available, limit network access to Android devices and restrict the granting of valid credentials to trusted accounts only. Application-layer mitigations (e.g., rate limiting, network segmentation) may provide temporary defense depth but are not substitutes for patching.

Patch guidance

Monitor Google's official Android Security & Privacy Year in Review and monthly security bulletins for patch availability. Once patches are released, verify the specific Android version and security patch level applicable to your devices. Apply updates via OTA (over-the-air) updates on managed devices or through your mobile device management (MDM) platform. Test patches in a pre-production environment if critical services depend on specific Android versions. Document patch deployment across your device inventory to confirm coverage.

Detection guidance

Monitor system logs and crash reports for abnormal terminations or segmentation faults in processes linked to ubsan_throwing_runtime.cpp. Network-based detection is difficult without payload signatures; focus on behavioral indicators such as repeated failed process spawning or denial-of-service patterns from internal or external authenticated users. Enable enhanced logging on Android devices if supported by your MDM solution. Security event aggregation (SIEM) can help correlate crashes with network activity to identify exploitation attempts.

Why prioritize this

Although the CVSS score is MEDIUM (6.5), this vulnerability warrants timely attention because it requires only authentication (not privilege escalation) and no user interaction for exploitation. The denial-of-service impact can degrade service availability for dependent systems and users. It is not yet in active exploitation, providing a window to patch before adversaries weaponize it. Prioritize patching for Android devices that are exposed to untrusted or semi-trusted networks or that support critical business functions.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a MEDIUM severity rating driven by: (1) Network attack vector (AV:N) allowing remote exploitation; (2) Low attack complexity (AC:L) with no special conditions required; (3) Low privilege requirement (PR:L) for a valid authenticated user; (4) No user interaction (UI:N); (5) High availability impact (A:H) from the denial-of-service effect. The absence of confidentiality and integrity impact (C:N/I:N) moderates the score. The requirement for prior authentication prevents a higher severity rating.

Frequently asked questions