A logic error in several functions of MediaProvider.java allows a permission bypass that can expose sensitive media information. This flaw does not require elevated execution privileges or any special user interaction; the offending code merely checks permissions incorrectly, allowing a local consumer to read data that should be protected. The consequence is a leakage of local information such as media metadata or file contents, potentially exposing personal or private data to any user or process with local access.

Google’s Android operating system is affected. The vulnerability is tied to the MediaProvider component, which is present in all Android releases unless a patch has been applied. No specific version or build information is provided, so all Android device variants that ship with the affected MediaProvider code are potentially impacted.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, implying limited public exploitation data. Nevertheless, the flaw is exploitable locally and does not require additional steps from the attacker. Because any user or application running on the device could trigger the bypass, the risk level can be considered moderate. The absence of an elevated privilege requirement keeps the severity lower than remote code execution, but the ability to expose private media content warrants attention. The official CVSS details are not supplied, so a precise weighted risk assessment cannot be given, but the local nature and lack of interaction suggest that the threat can be mitigated through the standard vendor update process.