This vulnerability exists in the importWrappedKey method of KMKeymasterApplet.java in Google Android. Due to improper input validation, an attacker with local access can retrieve keys that should be restricted, resulting in local information disclosure. Exploitation does not require elevated privileges or user interaction. The CVSS score is 4.0, indicating medium severity. The affected product is Android SoC. No patch or official remediation level has been disclosed by the vendor at this time.

An attacker with local access to the affected Android system can disclose sensitive key material that should be protected, potentially compromising confidentiality. There is no impact on integrity or availability, and no additional privileges or user interaction are required for exploitation. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to affected devices to trusted users only. Monitor vendor communications for updates on patches or mitigations.