What is the CVSS score of EUVD-2026-37555?

EUVD-2026-37555 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Android EUVD-2026-37555

| CVE-2026-0057 LOW

Missing Authorization (CWE-862)

2026-06-17 google_android

Authentication Bypass Information Disclosure Google

3.3

CVSS 3.1 · CISA-ADP

Severity by source

CISA-ADP PRIMARY

3.3 LOW

AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.0 MEDIUM

Local vector retained; UI:N adopted per description's explicit statement; PR:N as no permissions are required to trigger the flaw.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from CISA-ADP.

CVSS VectorCISA-ADP

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 21:31 vuln.today

CVE Published

Jun 17, 2026 - 05:53 cve.org

LOW 3.3

CVE Published

Jun 17, 2026 - 05:53 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In Contacts Provider, there is a possible way to access an incoming call's phone number and associated metadata due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

AnalysisAI

Missing permission check in the Android Contacts Provider allows a local application to access an incoming call's phone number and associated metadata without holding the required permissions. Affecting Android 17, this CWE-862 (Missing Authorization) flaw enables low-privilege local code to silently read call metadata without any user interaction, according to the description - though this conflicts with the official CVSS UI:R metric (see confidence notes). No public exploit code exists and CISA has not listed this in KEV; EPSS places it at the 3rd percentile, reflecting minimal exploitation interest at time of analysis.

Technical ContextAI

The Contacts Provider is an Android system content provider that manages contact and call-log data, accessed by apps through Android's content-resolver mechanism. Authorization to sensitive data should be enforced via Android permission declarations (e.g., READ_CALL_LOG or READ_CONTACTS), but this flaw - classified as CWE-862 (Missing Authorization) - indicates that a specific code path in the Contacts Provider fails to verify the caller holds the requisite permission before returning incoming call metadata. The affected product per CPE is cpe:2.3:a:google:android:*:*:*:*:*:*:*:*, scoped by EUVD to Android 17. The local attack vector (AV:L) reflects that exploitation requires code running on the device, consistent with Android's app sandbox model.

RemediationAI

Apply the patch distributed via the Android 17 Security Bulletin published by Google at https://source.android.com/docs/security/bulletin/android-17. Device manufacturers and carriers should propagate the security patch level update to end-user devices promptly. An exact fixed build version is not independently confirmed from available data beyond the bulletin reference - consult the bulletin for the specific security patch level (SPL) that addresses this CVE. No workaround is documented; given the local attack vector, restricting sideloaded or untrusted applications from running on affected devices reduces exposure until a patch is applied. Disabling unknown-source installations (Settings > Apps > Special app access > Install unknown apps) limits the attack surface without significant operational trade-off.