The vulnerability CVE-2026-0071 in Google Android's SettingsLib is due to a logic error resulting in a missing permission check. This flaw enables a local attacker to escalate privileges without requiring additional execution privileges or user interaction. The CVSS 4.0 base score is 10.0, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impacts on confidentiality, integrity, availability, scope, and security requirements. The affected version explicitly stated is Android 17. There is no vendor advisory or patch information available at this time.

Successful exploitation allows a local attacker to gain elevated privileges on the affected Android device without needing extra execution privileges or user interaction. This could compromise the confidentiality, integrity, and availability of the system at a high level. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users and administrators should monitor for updates from Google and apply patches promptly once available.