Android MmsProvider EUVD-2026-115427

Exploitation requires the attacker to already have local code execution on the target device, i.e. a locally installed malicious or compromised application, and a multi-user (secondary user or profile) configuration must be present for the isolation boundary to be meaningfully crossed. No user interaction and no additional execution privileges are required once the app is running (consistent with PR:N/UI:N). The vulnerable path is insertInternal of MmsProvider.java on Android 14, 15, 16, 16-qpr2, and 17. Limiting factors: the attack is strictly local (AV:L) with no remote vector, so it is only reachable after an attacker has already gotten an app onto the device, which bounds real-world risk despite the high base score.

Signals are consistent in pointing to a genuine but second-tier priority. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.4) describes a local, low-complexity flaw requiring no privileges or user interaction, which maps correctly to CWE-862 (missing authorization) and the described multiuser-isolation bypass in MmsProvider. However, AV:L means exploitation requires an attacker to already have local code execution on the device (a malicious or compromised app), so this is not a remote threat. The EPSS score is very low (0.11%, 1st percentile), and there is no CISA KEV listing and no public exploit identified at time of analysis, so there is no evidence of active or imminent widespread exploitation. The vuln.today Decision label is 'this_week', indicating it should be remediated promptly through the normal patch cycle rather than as an emergency. In short, this is a real, high-severity local privilege-escalation issue appropriate for the next scheduled Android update, not a high-CVSS-but-illusory risk nor a drop-everything emergency. One note of caution: the 'Authentication Bypass' tag overstates the mechanism - this is a missing permission check leading to multiuser isolation failure, not an authentication bypass in the login sense; treat the tag as loose labeling.

A malicious or compromised application installed under one Android user profile invokes the insertInternal path of MmsProvider, which lacks the permission check needed to enforce multiuser isolation, allowing it to write MMS data into or affect another user profile on the same device. Because no user interaction and no additional execution privileges are required, the app can perform this escalation silently in the background. No public proof-of-concept or exploit code has been identified at the time of analysis.