The vulnerability resides in Android’s VBMeta component, allowing a malicious party to modify and resign a device image with a test key that matches the key used to sign the original image. This flaw permits an attacker to gain elevated privileges on a device without any special execution rights or user interaction, potentially enabling the installation of unauthorized code or services. The weakness aligns with CWE‑269, improper restriction of excessive privileges.

Android operating systems released by Google are affected. No specific versions are listed, so the issue likely applies to all builds that incorporate Git‑based VBMeta signing procedures. The vulnerability is present wherever the same signing key can be reused to validate VBMeta metadata.

The CVSS score of 7.8 indicates a medium‑to‑high severity. The EPSS score of less than 1% suggests exploitation is unlikely at present, and the vulnerability is not in the CISA KEV catalog. Exploitation requires a local attacker who can access the device and the test signing key, but does not need any user interaction. If an attacker can obtain the key, the attack vector is local and straightforward, making the vulnerability noteworthy for devices exposed to insider threats or where test keys are stored insecurely.