In the VPU component of Android, a missing permission check can be exploited to bypass authorization controls, enabling a local user who does not require any user interaction to elevate privileges to System execution level. The vulnerability is a classic privilege‑escalation weakness, lacking proper authorization to access critical resources, and constitutes a security risk that could allow malicious apps or users to control privileged system functions.

Google Android devices are affected. The the operating system; specific version details are not provided in the advisory.

The CVSS score of 7.8 indicates a medium-to-high severity for Local Privilege Escalation, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the near term. This issue is not listed in the CISA KEV catalog, implying no known widespread exploitation. Attackers would need to have local access to the device and be able to run code within an unprivileged app; no user interaction is required. (This local access requirement is inferred from the lack of user interaction in the description). Once the bypass is achieved potentially leading to full device compromise.