This vulnerability involves a path traversal error in the createSessionInternal method of PackageInstallerService.java in Android. It allows a local attacker without prior privileges to update a Device Policy Controller (DPC) to an unintended directory, potentially leading to elevation of privilege. The flaw is present in Android versions 14, 15, 16, and 16-qpr2. The CVSS 3.1 base score is 6.2, reflecting medium severity with local attack vector, low attack complexity, no privileges required, and no user interaction needed. Confidentiality impact is high, while integrity and availability impacts are none. No official fix or patch information is currently available.

Successful exploitation can lead to local privilege escalation on affected Android devices by allowing unauthorized modification of Device Policy Controller files via path traversal. This could compromise device security by enabling elevated privileges without requiring user interaction or prior execution rights. However, there are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should apply general security best practices such as limiting local access to trusted users and monitoring device integrity. No vendor-provided mitigation or temporary fix is currently documented.