The vulnerability originates in multiple functions of attestation_object.c, where uninitialized data in the secure element stack can be included in key attestation certificates. This flaw could allow an attacker to read portions of memory that were never initialized, exposing sensitive information. The data disclosed could reveal internal state or cryptographic material, potentially aiding further attacks, though no additional execution privileges are required. The flaw is a pure information‑exposure issue rather than a code‑execution flaw.

This weakness affects Google Android devices; specific models or firmware releases are not enumerated in the advisory, but all builds that include the affected attestation_object.c code at the time of disclosure are likely impacted.

The exploitability of this defect is local; an attacker does not need to interact with other users or gain elevated privileges. The EPSS score is reported below 1%, indicating a low likelihood of widespread exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The potential impact is limited to the confidentiality of data stored within the device’s secure element stack, and the attack vector is inferred to be local to the device rather than remote. The absence of a need for user interaction reduces the attacker's effort but does not eliminate the risk if the device is compromised by other means.