CVE-2025-71251
Published: 06 May 2026
Summary
CVE-2025-71251 is a high-severity an unspecified weakness vulnerability in Google Android. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 16.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-71251 is a vulnerability in IMS due to improper input validation, which can result in a system crash. This issue affects IMS components, as documented in a Unisoc product security bulletin. The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily from its availability impact.
The vulnerability enables remote denial-of-service attacks with no additional execution privileges required. Any unauthenticated attacker with network access can exploit it at low complexity without user interaction, causing a system crash that disrupts service availability but does not compromise confidentiality or integrity.
Mitigation details are provided in the Unisoc product security bulletin at https://www.unisoc.com/en/support/product-security-bulletin/2051836844671422466. Security practitioners should consult this advisory for patching instructions and affected product versions.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-209647
Vulnerability details
In IMS, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Improper input validation in IMS directly enables remote exploitation causing system crash, matching Endpoint DoS via Application or System Exploitation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly enforces proper information input validation to prevent system crashes from malformed inputs exploiting this CVE.
SC-5 provides denial-of-service protection mechanisms to limit or block remote attacks causing availability impacts like the system crash in this CVE.
SI-2 ensures timely identification, reporting, and patching of flaws such as the improper input validation vulnerability documented in this CVE.