CVE-2025-68713 affects Rakuten Send Anywhere (File Transfer) for Android version 23.2.9. The vulnerability permits untrusted, permissionless applications to cause arbitrary files to be downloaded into the app's scoped storage area. Because these files are shown in the app's trusted Received interface, an attacker can leverage this to execute arbitrary code by delivering a malicious APK file or cause denial-of-service conditions by forcing oversized file transfers. The CVSS 3.1 base score is 8.0, indicating high severity with network attack vector, low attack complexity, requiring low privileges and user interaction, and impacting confidentiality, integrity, and availability. No official patch or remediation guidance is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker to execute arbitrary code on the device if the downloaded payload is a malicious APK, or cause denial-of-service by exhausting resources with large file transfers. This compromises the confidentiality, integrity, and availability of the affected device through the vulnerable app's trusted interface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when installing untrusted applications and avoid interacting with suspicious files received via the app. Monitoring for vendor updates is recommended.