The vulnerability is a missing permission check in the platform_msg_handler_init function of default_msg_handlers.c. This omission allows a local attacker to execute code with System-level privileges without needing any user interaction. The flaw enables full control over the device, including modification of system configuration, installation of additional software, or launching arbitrary programs.

This issue impacts Google Android devices. Specific affected product versions are not enumerated in the bulletin, so all Android builds that include the unpatched default_msg_handlers.c implementation are potentially vulnerable.

The CVSS score of 6.7 indicates a medium to high impact, and the vulnerability is not listed in the CISA KEV catalog. The missing permission check in platform_msg_handler_init allows a local attacker to achieve System-level privileges without user interaction, creating a high exploitation risk on any device running the affected code path. If the device is already compromised by malware or has physical access, an attacker can leverage this flaw to gain full control of the device.