Android EUVD-2026-73951

Exploitation requires local code execution on an Android device running Android 16-QPR2 or Android 17, with at minimum standard user-level (low) privileges - confirmed by CVSS PR:L. No user interaction is required once malicious code is running on the device, per CVSS UI:N and explicit description language. The vulnerability is strictly local (CVSS AV:L) and cannot be triggered remotely without a separate delivery mechanism. No specific Android feature, service, or non-default configuration needs to be enabled - the flaw is present in multiple baseline code locations in affected Android versions. Key limiting factors: attacker must first achieve local code execution on the device (via sideloaded app, separate vulnerability, or physical access); remote-only attackers cannot directly trigger this flaw.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.8 - High - indicating a reliably exploitable local privilege escalation with full confidentiality, integrity, and availability impact once the attacker has code execution on the target device. The low attack complexity (AC:L) and absence of required user interaction (UI:N) mean that a malicious application could trigger the flaw silently after installation. Against this, EPSS at 0.12% (2nd percentile) and the absence from CISA KEV confirm there is currently no evidence of active exploitation or publicly circulating exploit code, which materially lowers near-term real-world risk. The local attack vector (AV:L) acts as a natural limiting factor, restricting exploitation to attackers who already have an app running on the device or physical access to it - remote exploitation is not possible. The 'Denial of Service' metadata tag is most likely a secondary consequence of UAF crash behavior rather than an independent impact; the description exclusively identifies local privilege escalation as the primary outcome. Even a mid-sized municipal IT team in bytom managing a fleet of Android 17 enterprise devices should treat this as a patch-cycle priority rather than an emergency response, given no active exploitation but high post-exploitation impact. Conflicting signal: CWE-693 (Protection Mechanism Failure) is assigned, yet the description identifies a use-after-free - this may indicate the UAF is a downstream consequence of a protection mechanism failure rather than a direct memory management flaw; the exact Android subsystem is not identified in available data.

An attacker distributes a malicious Android application targeting devices running Android 16-QPR2 or Android 17. After installation, the application triggers the logic error at one of the multiple vulnerable code locations, causing the use-after-free condition to corrupt freed memory. This memory corruption is leveraged to overwrite kernel or framework data structures, silently escalating the application from a low-privilege user process to system or root level without any user interaction.