The flaw lies in the ap_pmic_poll_msg_handler function of ap_pmic_ipc.c, where a confused‑deputy condition allows a locally running application to bypass standard permission checks and invoke privileged IPC calls. This bypass permits an attacker to request system execution privileges without needing user interaction, resulting in full system control if executed successfully. The vulnerability is a classic permission‑bypass and is noted as a CWE‑441 weakness.

Android devices containing the vulnerable ap_pmic_ipc implementation, which is present in any Android build that has not yet been updated with the corresponding security fix. The component is typically part of the platform’s power management interface and may be used by core system services as well as third‑party applications that request power‑related IPC messages.

The CVSS score of 6.7 classifies this local privilege escalation as high severity, while the EPSS score of less than 1 percent indicates a low probability of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation can be achieved by installing a malicious application that utilizes the faulty IPC routine; no network or user interaction is required. If triggered, the, potentially allowing full compromise of device confidentiality, integrity, and availability.