CVE-2026-0080: Android Integer Overflow Remote Denial of Service

Technical summary

The vulnerability exists in multiple functions within ubsan_throwing_runtime.cpp and stems from improper handling of integer arithmetic operations (CWE-190). An integer overflow condition allows a remote attacker with low-privilege credentials to send specially crafted input that causes the runtime to crash. The undefined behavior sanitizer (ubsan) runtime is a component that checks for runtime errors during execution; when the overflow occurs, it leads to an unhandled exception and process termination rather than graceful error handling.

Business impact

Availability is the primary concern. An attacker with any valid Android account credentials can remotely trigger repeated device crashes or service unavailability, degrading user experience and potentially impacting business continuity for organizations relying on Android-based infrastructure or kiosk deployments. There is no confidentiality or integrity risk; the attack is purely denial of service.

Affected systems

This vulnerability affects multiple versions of Google Android. Consult Google's official Android Security & Privacy Release Bulletin to identify the specific Android versions and patch levels that are vulnerable and determine which devices in your fleet are at risk.

Exploitability

The attack has low barriers to entry: it requires only a valid login credential (typical network access requirement for Android services) and can be executed programmatically without user interaction. The CVSS score of 6.5 (MEDIUM) reflects the combination of network accessibility and low privilege requirement, offset by the absence of confidentiality or integrity impact. This is not currently listed on CISA's Known Exploited Vulnerabilities catalog.

Remediation

Apply the security patch released by Google for Android as soon as it becomes available for your device models and OS versions. Patch application should be prioritized for devices exposed to untrusted networks or those handling business-critical workloads. Until patching is complete, consider network-level controls to restrict access to Android services and monitor authentication logs for suspicious account activity.

Patch guidance

Visit Google's Android Security & Privacy Release Bulletin to identify the patch version for your specific Android version and device model. Security updates are typically released monthly. Some devices may require carrier approval before patches propagate, so verify patch availability through your device manufacturer's or carrier's update channels. Test patches in a limited production environment before wide deployment.

Detection guidance

Monitor system logs and crash reports for repeated terminations of ubsan-related processes or the affected runtime component. Network-based detection is challenging since the exploit uses legitimate authentication, but endpoint detection should flag multiple authentication attempts from the same account followed by service crashes. Android devices can forward logs to a Security Information and Event Management (SIEM) system for correlation and alerting.

Why prioritize this

Although this is a medium-severity vulnerability, it should be addressed in your Android patch cycle because it enables simple, unauthenticated-adjacent denial of service with no exploitation complexity. Organizations running Android in critical roles (medical devices, point-of-sale systems, infrastructure management) should prioritize patching. If Android devices in your environment are not exposed to untrusted users with valid credentials, risk can be temporarily mitigated through access controls.

Risk score, explained

The CVSS 3.1 score of 6.5 is driven by: (1) Network-accessible attack vector, (2) Low privilege requirement (authenticated user), (3) No user interaction needed, (4) High availability impact (crash/denial of service), and (5) No confidentiality or integrity impact. The score reflects a meaningful but contained threat that warrants patching within normal security update cycles rather than emergency response.

Frequently asked questions