A logic error in the oobconfig component can bypass carrier restrictions, allowing a local attacker to elevate privileges without requiring additional execution privileges or user interaction. The flaw results in unauthorized access to system resources, posing a significant subversion risk to device integrity. This weakness aligns with unchecked or missing authorization controls (CWE‑693).

The vulnerability affects Google Android. No specific Android versions are listed, so all devices running affected releases are potentially impacted until inventory and patching are confirmed.

The flaw carries a CVSS score of 8.4, indicating high severity, yet its EPSS score of less than 1% suggests a low likelihood of exploitation at present. It is not listed in the CISA KEV catalog. Exploitation can occur locally and does not require user interaction, implying that any privileged user or service with file access could trigger the escalation path. The primary attack vector is a local privilege escalation through logic bypass of carrier restriction checks.