This vulnerability exists in the importWrappedKey method of KMKeymasterApplet.java within Android SoC devices. Due to improper input validation, an attacker with local access could potentially disclose cryptographic keys that should be restricted. The vulnerability does not require any additional privileges or user interaction to exploit. The CVSS v3.1 base score is 4.0, reflecting a low complexity attack vector with limited confidentiality impact and no integrity or availability impact. No patch or official remediation level has been disclosed by the vendor as of the publication date.

An attacker with local access to the affected Android SoC could exploit this vulnerability to gain unauthorized read access to cryptographic keys. This leads to local information disclosure but does not affect system integrity or availability. No remote exploitation or user interaction is required. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to affected devices and monitor for updates from Google regarding patches or mitigations.