The vulnerability arises in the gem_msg.c component of the Android operating system, where the is_pd_allowed function omits a required permission check. This missing authorization step allows any process that already possesses system execution privileges to call privileged functions and read protected data, leading to local information disclosure. The flaw does not require user interaction, meaning a malicious local app or a privilege‑escalated attacker can exploit it directly.

Affected systems are Android devices operating the Google Android platform. The issue exists in any build that includes the vulnerable gem_msg.c code; no specific version list is provided in the advisory.

Because the bug requires system‑level privileges, the attack surface is limited to local attackers who can obtain such privileges through exploits or by installing malicious components with elevated rights. The CVSS score of 4.4 indicates moderate risk, and the EPSS score is not available at this time. The vulnerability is not listed in the CISA KEV catalog, suggesting no widely known exploitation currently. Nevertheless, the lack of an authorization check presents a significant insider threat and a high‑impact weakness within the device’s privileged services.