An incorrect bounds check in several persistence functions can desynchronize state, allowing a local user to elevate privileges without additional execution rights or user interaction. The flaw allows manipulation of data that the system trusts, potentially granting the attacker root or system-level access and compromising confidentiality, integrity, and availability of the device. This flaw is classified under the common weakness enumeration identifier CWE-120.

Google Android devices are impacted; no specific version information is provided in the advisory. The vulnerability applies to the core Android system components that handle persistence.

The vulnerability poses a high risk due to its nature as a local privilege escalation. The vulnerability has a CVSS score of 7.8, and the EPSS score is unavailable, but the lack of user interaction and the potential for unauthenticated privilege escalation suggest a severe threat. The vulnerability is not listed in the CISA KEV catalog, and a public exploit has not been documented. Attackers would operate from a local context with existing user privileges and could exploit the bounds check failure to gain elevated rights.