CVE-2026-0051: Android UBSan Runtime Denial of Service Vulnerability

Technical summary

CVE-2026-0051 is an input validation flaw (CWE-20) affecting the ubsan_throwing_runtime.cpp module across multiple Android versions. The vulnerability resides in the UBSan runtime, which instruments code to detect undefined behavior at runtime. Improper validation of crafted input to several functions permits an authenticated remote attacker to trigger an unhandled exception or crash, resulting in denial of service. The attack vector is network-based, access complexity is low, and no user interaction is required, making it trivial to trigger once authenticated.

Business impact

For organizations running Android infrastructure or relying on Android devices for critical workflows, this vulnerability creates availability risk. Authenticated accounts—whether compromised or malicious insiders—can remotely crash Android systems without warning. For device manufacturers and Android platform operators, this represents a service resilience issue; for enterprise deployments, it threatens uptime for applications and systems dependent on affected Android versions. The low barrier to exploitation (authentication only, no UI interaction) amplifies the operational risk.

Affected systems

Multiple versions of Google Android are affected. The source data identifies six references to 'google android' without specifying exact version ranges; consult the official Android Security & Privacy Year in Review and Google's Security Bulletins to identify your specific Android version(s) and determine applicability. Devices running vulnerable builds are at risk if they expose network-facing services or APIs callable by authenticated users.

Exploitability

This vulnerability has a moderate-to-low barrier to exploitation. An attacker must possess valid credentials (authentication is required per the CVSS vector), but once authenticated, no additional privileges, complex attack chains, or user interaction are needed. The network-accessible nature of the vulnerability and the simplicity of triggering it via malformed input make it exploitable by low-skill actors with valid accounts. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog as of the latest update, suggesting limited public weaponization to date, but that status may change.

Remediation

Apply the latest Android security patch released by Google. Verify the specific patch version for your Android build by consulting Google's monthly security bulletins and cross-referencing your device model and version. In parallel, consider network segmentation to limit which authenticated users can reach affected Android services, and monitor authentication logs for suspicious account activity. If immediate patching is delayed, restrict authentication privileges to reduce the attack surface.

Patch guidance

Monitor Google's Android Security & Privacy Bulletin for the specific patch version addressing CVE-2026-0051 for your Android build. Patches are typically released monthly; apply them as soon as feasible. Test patches in a non-production environment first to ensure compatibility with dependent applications. For enterprise deployments, coordinate patch rollout with your device management and application teams to minimize disruption. Verify patch application by checking the Android Security Patch Level in device settings and confirming it is dated on or after the bulletin's patch release date.

Detection guidance

Monitor for abnormal process termination or system crashes originating from the ubsan_throwing_runtime component or UBSan instrumentation. Implement logging on authentication endpoints to identify which accounts are accessing Android services and from which origins. Correlate authentication logs with crash dumps or system event logs to detect exploitation attempts. In high-security environments, consider runtime monitoring tools that detect anomalous memory access or exception patterns. Be alert for repeated crashes following authentication by the same account, which may indicate active exploitation.

Why prioritize this

While the CVSS score of 6.5 (MEDIUM) reflects the authentication requirement and lack of confidentiality or integrity impact, the ease of exploitation, low attack complexity, and high availability impact warrant prompt attention. Authenticated denial of service vulnerabilities are operationally disruptive and are often exploited by insiders or attackers with compromised credentials. The lack of KEV designation suggests this is not yet a widespread active threat, providing a window to patch proactively before public tools emerge.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) is driven by: network accessibility and low attack complexity (favoring higher score); requirement for prior authentication (limiting scope); and high availability impact (denial of service causes system unavailability). The attack vector being network-based and the lack of required user interaction offset the authentication requirement. The absence of confidentiality and integrity impact prevents a higher score, but organizations should not underweight availability—production systems dependent on Android deserve urgent attention.

Frequently asked questions