An Android component responsible for processing NFC enhanced event data contains a missing permission check. This flaw permits a local user to perform arbitrary code execution within the NFC subsystem, effectively elevating privileges without the need for additional attack stages or user interaction. The resulting local escalation can grant the attacker full control over the device’s NFC services and potentially broader system capabilities.

The vulnerability affects Android devices running the NFC enhanced event (NFCEE) handling code. Vendor Google is impacted; specific Android versions or releases are not enumerated in the available data, so all devices containing the vulnerable component should be inspected.

The EPSS score is <1%, indicating a very low but nonzero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw is local and bypasses permission checks, exploitation is possible on any device where the attacker has physical or local access and can trigger the vulnerable NFC payload. The CVSS score of 8.4 indicates high severity for local privilege escalation with no user interaction, making this a high‑risk issue for affected devices.