A flaw in Android causes an uncaught exception that can trigger a crash, leading to a denial of service. An attacker with local access can exploit the same failure to elevate privileges, granting them higher permissions on the device. The vulnerability does not require additional execution privileges or user interaction. The core weakness is an uncaught exception and improper access control.

Android devices supplied by Google that have not yet applied the October 1 2026 security bulletin. The advisory does not specify which releases are affected, so all devices remaining on older builds are potentially vulnerable.

The CVSS score of 7.8 is disclosed, and the issue is not listed in KEV. The flaw can be triggered locally without user interaction, and an authenticated user on the device could potentially exploit it. The severity of the privilege escalation, combined with the ease of triggering the crash, warrants a high‑priority response.