This vulnerability exists in the isSameApp method within NotificationManagerService.java on affected Android versions. It allows a local attacker with limited privileges to cause persistent denial of service through resource exhaustion. The CVSS 3.1 base score is 5.5, reflecting a medium severity impact focused on availability (denial of service) without confidentiality or integrity impact. No user interaction is required for exploitation, and the attack vector is local.

Successful exploitation results in a persistent denial of service condition on the affected Android device, impacting availability. There is no impact on confidentiality or integrity, and no additional privileges are required to exploit this vulnerability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users and administrators should monitor Google advisories for updates and apply patches once available.