CVE-2026-0079: Android Integer Overflow DoS in ubsan_throwing_runtime

Technical summary

The vulnerability stems from inadequate integer overflow handling in ubsan_throwing_runtime.cpp, a component of Android's runtime environment. Specifically, multiple functions fail to validate integer arithmetic operations before use, triggering integer overflow conditions classified under CWE-190 (Integer Overflow or Wraparound). When exploited, these overflows corrupt internal state or trigger resource exhaustion, resulting in persistent denial of service. The attack surface is local; no network vector exists. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects low attack complexity, low privilege requirements, and complete availability impact confined to the attacked system.

Business impact

This vulnerability creates operational risk for organizations managing Android deployments. Affected devices can be rendered unavailable or unstable by local processes, disrupting productivity and requiring manual recovery. For enterprise environments relying on Android for critical workflows—field operations, point-of-sale, industrial IoT—persistent denial of service translates directly to downtime costs. The flaw does not compromise confidentiality or integrity, so data exfiltration or tampering is not a concern, but availability degradation can cascade if affected devices support backend services or user workflows.

Affected systems

Google Android is affected across multiple versions. The source data indicates multiple affected product entries without granular version delineation in this record. Organizations must cross-reference official Google Android security advisories to determine which specific Android OS versions and patch levels are vulnerable. Check vendor.google.com/security or your device manufacturer's security bulletin for precise version ranges and affected device models.

Exploitability

The vulnerability is exploitable with relatively low barriers to entry: attackers need only local system access (already available to most user-level processes) and can trigger the flaw without user interaction or social engineering. Attack complexity is low—the integer overflow condition is straightforward to trigger programmatically. No special capabilities, exotic hardware, or privileged access are required. This makes the flaw attractive to local privilege-escalation chains or malicious apps seeking to disable device functionality, though it does not itself elevate privileges.

Remediation

Remediation requires patching to a corrected Android version that includes integer overflow validation in ubsan_throwing_runtime.cpp. Google's security team has addressed this issue; organizations should obtain the patch from their device manufacturer or Google's Android security release notes (published June 2026 or later, per modification date). No workarounds mitigate the underlying code defect—patching is the definitive remediation. Organizations unable to patch immediately should monitor for suspicious local process behavior and restrict sideloading of untrusted applications.

Patch guidance

Verify the exact patched Android version against Google's official June 2026 security advisory for ubsan_throwing_runtime.cpp fixes. Device manufacturers typically bundle security patches into monthly or quarterly updates; check your device manufacturer's support page for availability timelines. If you manage Android devices centrally via MDM, deploy patches via your management console. Test patches in a staging environment first to confirm compatibility with business applications. For devices no longer receiving security updates, consider phased migration to supported Android versions.

Detection guidance

Monitor system logs for crashes or hangs in runtime processes (particularly those related to undefined behavior sanitization). Device telemetry showing repeated spontaneous reboots or process terminations of system runtime services may indicate exploitation attempts. On rooted or debugging-enabled devices, use logcat to observe runtime exceptions with integer overflow signatures. Behavioral anomalies such as apps unexpectedly terminating or the system becoming unresponsive intermittently warrant investigation. Note that legitimate integer overflows in unrelated code may generate similar signals, so correlation with suspicious process origins is important.

Why prioritize this

Although this vulnerability carries a CVSS score of 5.5 (MEDIUM), it warrants prioritized attention because: (1) it requires no user interaction or elevated privileges, lowering the barrier to exploitation; (2) it enables persistent denial of service, affecting availability—a critical concern for operational environments; (3) it resides in a core runtime component, meaning widespread exposure across affected Android versions; (4) malicious applications or local privilege-escalation exploits commonly chain DoS flaws to destabilize targets before further attacks. Organizations with business-critical Android deployments should treat this as a near-term patching priority despite the MEDIUM severity score.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects the availability-only impact (no confidentiality or integrity loss), local-only attack vector, and requirement for low-level user privileges. Attack complexity is low and user interaction is unnecessary, which prevents the score from dropping further. The score does not rise to HIGH because the impact is scoped to the individual affected system and does not propagate to other systems. In practice, the operational risk may exceed the numerical score if the vulnerability is exploited at scale across a large Android device fleet; contextual factors like device criticality and incident response capacity should inform prioritization beyond the CVSS number alone.

Frequently asked questions