The vulnerability resides in several functions of Android’s MmiUtils.java. Improper validation of user-supplied USSD/MMI code can trigger code execution that elevates the local process’s privilege level. Attackers do not need additional execution privileges beyond the normal user context; the flaw’s exploitation requires user interaction to send the malformed USSD/MMI request.

Google Android mobile devices are affected. No specific Android release or API level has been identified in the advisory.

The flaw is a local privilege escalation vector that depends on a user’s interactive sending of a crafted USSD/MMI message. Because user interaction is required and no external execution privileges are needed, the exploitation complexity is moderate. The CVSS score and EPSS are not published, and the vulnerability is not listed in the CISA KEV catalog, indicating that it is not a known widespread threat at this time.