During permission checks in Android's TelephonyProvider, a logic error allows an application to bypass required permissions, enabling local information disclosure. The flaw does not require elevated privileges or additional execution capabilities. The potential for sensitive data leakage is limited to local device contexts, but it could be a stepping stone for more damaging attacks if combined with other vulnerabilities.

Android devices running Google Android are affected by this flaw. No specific product versions are listed in the advisory, so all current Android releases are potentially vulnerable until a patch is issued.

The vulnerability is exploitable locally without user interaction, meaning any app present on the device could trigger it. While the CVSS score is not provided, the attack simplicity places this at non‑trivial risk. The EPSS score is unavailable and the issue is not currently in CISA's KEV catalog, suggesting no public exploit is known yet, but the basic logic error means a straightforward exploit could be crafted. Administrators should consider this a moderate to high risk until a vendor‑issued fix is applied.