The defect lies in the importWrappedKey routine of Android’s KMKeymasterApplet. A flaw in input validation allows a local caller to supply malformed data that bypasses protection checks, exposing cryptographic keys that are meant to be restricted. This is a classic example of CWE‑20, Improper Input Validation, which leads to a confidentiality breach identified as CWE‑200, Information Exposure.

The vulnerability affects all Android builds that ship with the affected keymaster component, as specific versions are not listed in the advisory. The flaw is present in the Google Android platform, so any device running the platform and allowing local code execution could be impacted. Users with physical or local access to the device could exploit this without additional privileges or user interaction.

The EPSS score is under 1 percent and the issue is not recorded in the CISA KEV catalog, implying a low probability of widespread exploitation at present. Nonetheless, because it does not require elevation or network access, a malicious local application could obtain sensitive keys at any time. Applying the latest vendor patches and monitoring for anomalous keymaster usage remain recommended mitigations.