The flaw is a possible memory corruption caused by a use after free in the lwis_device_external_event_emit function from the Android lwis_event component. The vulnerability allows an attacker who can trigger the freed object to overwrite or corrupt memory and eventually gain higher privileges. The documented impact indicates that local privilege escalation to System execution level is feasible without requiring user interaction. This vulnerability represents a CWE‑416 kind of flaw, a use‑after‑free error that disrupts memory integrity and can be exploited by a malicious local user or process.

This issue affects Google’s Android operating system. The CVE entry lists Google:Android as the affected vendor, but no specific version range was supplied. Administrators should verify the Android release on their devices and check Google’s security bulletin for equivalent fixes or mitigations.

The CVSS score of 7.8 reflects a high‑severity local privilege escalation risk. The EPSS score of less than 1% suggests that exploitation probability is currently low. The vulnerability is not listed in the CISA KEV catalog, indicating it has not been reported as a widely exploited flaw. A local attacker can exploit the use‑after‑free without user interaction, making the attack path feasible on any system where the affected component runs.