A incorrect bounds check in several functions of NotificationChannel.java can desynchronize the persistence state, potentially allowing a local user to elevate privileges. This flaw enables the attacker to gain elevated rights without needing additional execution privileges, and no user interaction is required for exploitation. The CVSS score of 7.8 indicates a high severity, and this weakness is categorized as CWE‑120.

Google Android devices are impacted; no specific version information is provided in the advisory. The vulnerability applies to the core Android system components that handle persistence.

The vulnerability poses a high risk due to its nature as a local privilege escalation. The vulnerability has a CVSS score of 7.8, and an EPSS score of < 1% indicates a very low exploitation probability, but the lack of user interaction and the potential for unauthenticated privilege escalation suggest a severe threat. The vulnerability is not listed in the CISA KEV catalog, and a public exploit has not been documented. Attackers would operate from a local context with existing user privileges and could exploit the bounds check failure to gain elevated rights.