This vulnerability in Google Android arises from a resource exhaustion issue in the onHeaderDecoded method within LocalImageResolver.java. It can cause a persistent denial of service locally without requiring user interaction or elevated privileges. The affected Android versions include 14, 15, 16, and 16-qpr2. The CVSS 3.1 base score is 6.2, reflecting a medium severity denial of service impact with low attack complexity and no required privileges or user interaction.

Successful exploitation leads to a local denial of service condition through resource exhaustion, causing the affected device or process to become unresponsive or degraded. There is no impact on confidentiality or integrity, and no additional execution privileges are gained. The vulnerability does not require user interaction, increasing the risk of automated or background exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor for updates from Google and apply them promptly once available. No specific temporary mitigations are provided by the vendor at this time.