The vulnerability arises from a missing permission check in RingtoneFactory.getRingtone, allowing an application to access ringtone data without providing the required permissions. This results in local information disclosure; no privilege escalation or additional execution rights are required, and no user interaction is necessary for exploitation.

The affected product is Google Android; any Android device that has not applied the latest security updates contains the vulnerable RingtoneFactory implementation.

An attacker who can execute code locally or run a malicious app on the device can directly query RingtoneFactory and read ringtone information. The exploit requires no elevated privileges and can be performed without prompting the user. Because EPSS data is unavailable and the vulnerability is not listed in the KEV catalog, the risk persists primarily on unpatched devices, but the likelihood of exploitation is considered non‑negligible due to the simplicity of the attack path.