A missing permission check in the insertInternal method of Android’s MmsProvider exposes a multiuser isolation flaw, enabling a local application to elevate its privileges without further permissions or user interaction. This flaw allows the malicious app to perform operations normally restricted to system or other user profiles, potentially compromising the confidentiality, integrity, and availability of user data across the device.

The defect resides in the Android operating system’s MmsProvider component. It affects all devices running the default MMS provider implementation; vendor‑customized versions that have not patched the default source are implicated. No specific version range is supplied, so any Android installation that has not received the corresponding security update may be vulnerable.

The exploit is purely local and does not require user interaction. The EPSS score of <1% indicates a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, the CVSS score of 8.4 reflects a high severity due to the potential for broad access to sensitive data. Attackers who gain local execution can elevate privileges and access data across user profiles, making the risk moderate in likelihood but severe in impact.