The KMKeymasterApplet implementation in Android contains an input validation flaw in its importWrappedKey routine. An attacker able to supply crafted data to this method can retrieve cryptographic keys that were intended to remain inaccessible. The vulnerability does not require elevated privileges or any user interaction, meaning a local adversary or malicious application can exploit it directly on the device. While the compromise remains limited to key material, the disclosure can enable the attacker to decrypt stored data or impersonate the device.

Android devices whose operating system contains the unpatched KMKeymasterApplet are affected. No specific OS releases are enumerated in the advisory, implying that all versions lacking the fix remain vulnerable until an over‑the‑air update or manual patch is applied by Google.

The CVSS vector indicates low severity with a score of 4.0, and the EPSS value is below 1 %, suggesting a very low likelihood of exploitation. The vulnerability is absent from the CISA keV catalog, indicating no known active exploitation. A local attacker or any code executing on the device can trigger the flaw, but remote exploitation or privilege escalation is not supported by the description.