The vulnerability is a missing permission check in the platform_msg_handler_init function of default_msg_handlers.c. This omission allows a local attacker to execute code with System-level privileges without needing any user interaction. The flaw enables full control over the device, including modification of system configuration, installation of additional software, or launching arbitrary programs.

This issue impacts Google Android devices. Specific affected product versions are not enumerated in the bulletin, so all Android builds that include the unpatched default_msg_handlers.c implementation are potentially vulnerable.

The CVSS and EPSS scores are not available and the vulnerability is not listed in CISA KEV, but the missing permission check means that exploitation can be performed on any device running the affected code path. Because no user interaction is required, the attack can be carried out from a local context, making the risk high if the device is compromised by malware or physical access.