The security flaw resides in the handleUssdRequest method of PhoneInterfaceManager.java, where a logic error allows an application to initiate a USSD request without possessing the required USSD permission. This oversight enables a local privilege escalation: a non‑privileged user can trigger privileged USSD actions without any additional privileges or user interaction. The weakness is an improper access control check, as the system incorrectly assumes the caller has appropriate rights.

Android devices that incorporate the affected PhoneInterfaceManager implementation are impacted. The vulnerability is tied to the Android platform itself, and any device running a version of Android that has not yet applied the official security patch will be susceptible.

The CVSS score is 7.8, indicating a high‑severity vulnerability. The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, suggesting that exploitation is not publicly observed yet. The attack vector is local, and no user interaction is required, making it potentially exploitable when an attacker can execute code without elevated privileges, it poses a significant threat to device security.