This vulnerability arises from a logic error in the createSessionInternal method within PackageInstallerService.java on Google Android. Exploiting this flaw can cause a permanent denial of service condition on the affected device. The attack requires no additional execution privileges and does not require user interaction, making it a local DoS vulnerability. The affected versions explicitly identified are Android 16-qpr2 and 17. There is no CVSS score or vendor advisory indicating remediation status at this time.

An attacker with local access can trigger a permanent denial of service on the affected Android device, potentially rendering it unusable until recovery actions are taken. No privilege escalation or remote exploitation is indicated. The impact is limited to denial of service without additional execution privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should limit local access to trusted parties and monitor for vendor updates.