The reported bug occurs in the secure_transport_usecase_handshake function of secure_transport.c. A logic error allows an attacker to bypass the encryption that normally protects the transport channel. Because the channel can be left unencrypted, data sent can be read or modified and local processes can gain elevated privileges. The flaw enables local privilege escalation on the device without any need for additional execution capabilities or user interaction.

All Android devices that employ the impacted secure_transport.c implementation from Google are potentially affected. No specific Android versions are listed in the advisory, so the risk applies broadly to all current releases using this code path.

The EPSS score of less than 1% indicates a very low probability of exploitation at this time, and the vulnerability is not currently listed in CISA KEV. Because the flaw requires local access and does not need a user click, an attacker with physical or local context could exploit the logic error to elevate privileges. The absence of a public exploit and the need for local access reduce the immediate threat, but the local escalation impact remains severe.