A logic error in SettingsLib enables an application or system component to be disabled without user interaction, allowing a local attacker to elevate privilege. The flaw does not require any further execution privileges and can be triggered by simply interacting with the affected component. The impact is a loss of confidentiality, integrity and control over system services normally protected by the operating system.

Google Android devices are affected. The specific Android releases that contain the vulnerability were not enumerated in the advisory, but the issue is noted in the Android 17 security bulletin.

The CVSS score is not provided, but the EPSS score of less than 1% indicates a low probability of exploitation in the wild. Nevertheless, the vulnerability is listed in the Android 17 bulletin and is not part of CISA’s KEV catalog. Exploitation requires local access to the device, and no user interaction is needed, which increases the risk for any compromised machine.