The flaw exists in the platform_msg_handler_init function of default_msg_handlers.c, where a confused deputy bug (CWE‑441) allows a component running with lower privileges to act as if it had elevated System execution rights; this can be exploited locally without any user interaction.

All Android devices that run the default_msg_handlers implementation and have not applied the September 2026 security update referenced in the Android security bulletin; the vendor is Google and the product is the Android operating system.

The CVSS score of 6.7 indicates medium severity and the EPSS score of < 1% shows a very low but non‑zero likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Because it can be triggered locally without user interaction, the risk remains significant for any device that may execute untrusted code. The likely attack vector is a local compromise scenario where a malicious process crafts messages that are processed by the default message handlers, escalating its privileges to System level.