Android EUVD-2026-73993

Exploitation requires a low-privilege process already executing on the target Android device - for example, an installed application with standard app-level privileges. The vulnerability triggers during the WriteImageToDisk code path in the Android Runtime, so exploitation depends on inducing or racing a runtime image write operation. No user interaction is required after initial app installation. Limiting factors include: the attacker must have local code execution (AV:L), the attack is not automatable remotely (SSVC Automatable: no), and exploitation is not feasible without an existing foothold on the device. This is not a remote vulnerability and cannot be triggered over the network.

The CVSS 7.8 local score is well-calibrated: the attack vector is local (AV:L), complexity is low (AC:L), and only low privilege is required (PR:L), with no user interaction needed - all three impact dimensions (C:H/I:H/A:H) are high, reflecting the total control obtainable via privilege escalation. The SSVC assessment corroborates this profile with Technical Impact: total but Exploitation: none, indicating no current in-the-wild activity. EPSS data is not provided, but the combination of no active exploitation, local-only attack vector, and non-automatable nature (SSVC Automatable: no) suggests measured urgency rather than emergency response for most organizations - even a mid-sized municipal IT team in malbork should treat this as a priority patch-cycle item rather than an emergency break-fix. The breadth of affected Android versions (14 through 17) increases aggregate exposure, especially given Android's massive global device footprint.

An attacker with a low-privilege application already running on the device (installed via any vector) triggers a runtime image write operation and exploits the logic error in WriteImageToDisk to substitute or tamper with a file on disk before or during the write. Because ART image files can influence code loaded at runtime, tampering with these files can redirect execution to attacker-controlled code running at an elevated privilege level. No public proof-of-concept exists at time of analysis, but the AC:L rating indicates no complex timing or memory state requirements.