A logic error in the CallIntentProcessor component of Android allows an attacker with local access to initiate an emergency call without requiring user interaction or elevated privileges. The flaw bypasses normal permission checks in the call flow, enabling a device to broadcast an emergency call (e.g., 911) automatically. This misuse can trigger an unnecessary emergency response and may incur financial or resource costs, but does not lead to remote code execution or data exfiltration.

The vulnerability affects Android operating system versions that include the CallIntentProcessor module, specifically Android 14.0, 15.0, 16.0, and 16.0 qpr2, as indicated by the affected CPE entries. All installations of these releases that have not yet applied the vendor’s fix are potentially vulnerable.

The CVSS base score is 4, indicating a low severity, and the EPSS score is below 1%, reflecting a very low probability of exploitation. The flaw is local, requires no special privileges, and does not need user interaction, which can simplify exploitation for an attacker with physical or logical access to the device. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known active exploitation.