Android Package Manager EUVD-2026-37564

Attacker must already have local code execution on the Android 17 device as an unprivileged app (any installed APK suffices - no special signature or permission grants required, per 'no additional execution privileges needed'); no user interaction is required. Exploitation is limited to devices running an Android 17 build prior to the bulletin's patch level and is most impactful where a Device Lock Controller is actually configured (enterprise-managed or financed devices) - on devices without an active device-lock policy, bypassing the controller has limited practical benefit. The CVSS 4.0 AV:N rating in the input contradicts the 'local' wording in the description; treat as local access required pending vendor clarification.

The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N with high impact on both vulnerable and subsequent systems) yields a 10.0 score, but this conflicts sharply with the description, which clearly states 'local escalation of privilege' - an AV:L scenario. The AV:N rating is almost certainly a vector-generation error in the Android bulletin; defenders should treat this as a local-only EoP. EPSS and KEV data are not provided, and no POC has been published. Realistic risk: high for unmanaged or rooted-fleet environments and for malware authors targeting Android 17 devices under device-lock policies (e.g., financed handsets), but lower for general consumer fleets that patch promptly. The mismatch between vector and description is the most important uncertainty.

A malicious application installed on an Android 17 device - for example a financed handset under a carrier device-lock program - invokes the unprotected Package Manager API path and bypasses the device-lock-controller restriction without prompting the user, allowing the device to be used outside its policy envelope or escalating privileges available to the malicious app. No POC is currently public, so realistic exploitation depends on a threat actor developing the trigger from the patch diff.