The flaw lies in SubscriptionManagerService.getSubscriptionProperty, where a missing permission check lets a local process read subscription details that should be protected. The disclosure does not require elevated privileges or user interaction, so any malicious application with code execution rights on the device can extract subscription data. The result is local information disclosure of subscription information, potentially revealing service usage, tiers, and billing details.

Android devices from Google. No specific OS versions are listed, so the vulnerability may affect any release that has not incorporated the permission check fix. The issue is present in the SubscriptionManagerService component of the Android framework, making any device running that code prior to patching potentially vulnerable.

The EPSS score is unavailable and the vulnerability is not in the CISA KEV catalog, so formal exploitation probability is undefined. Nonetheless, because it can be triggered by any local user without needing elevated privileges or user interaction, malicious applications or attackers with local code execution can exploit it at any time. The lack of a stealthy requirement raises the risk that an exploited device may leak subscription data to the attacker. Although a CVSS score is not provided, a local information disclosure of this nature warrants significant concern for privacy.