A logic error in the CallIntentProcessor component of Android allows a local attacker to trigger an emergency call with no privileges required and without user interaction. This flaw bypasses normal permission checks. The attacker can place a 911 call (or equivalent emergency service) that may lead to unnecessary emergency response and potential cost or service disruption. No remote execution or data exfiltration is possible; the impact is confined to the misuse of emergency call functionality.

The flaw exists in the Android operating system within the CallIntentProcessor module. No specific version numbers are provided; therefore, all Android releases that contain this component and have not yet applied a vendor fix are potentially affected. The attack surface is local to the device, requiring the attacker to be present on or have physical or logical access to the device.

The CVSS score is 4, and EPSS data is unavailable, so the severity is quantified as low. However, the vulnerability is local, requires no user interaction, and can be exploited without privileged access, indicating a high potential for misuse. It is not listed in the CISA KEV catalog, suggesting no documented exploitation at this time. The likely attack vector is local exploitation, where an attacker with physical or accessed device privileges can trigger the call.