This vulnerability involves a use-after-free flaw in the Nfc::eventCallback() function within Android's NFC component. The root cause is a race condition that can lead to memory being accessed after it has been freed. Successful exploitation allows a local attacker to elevate privileges without needing any prior execution privileges or user interaction. The CVSS 4.0 score is 10.0, indicating a critical severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability is tracked as CWE-362 (Race Condition).

An attacker with local access can exploit this vulnerability to gain elevated privileges on the device, potentially compromising system integrity and security. No additional privileges or user interaction are required, increasing the risk of exploitation. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround has been published by Google as of now. Users and administrators should monitor Google's security advisories for updates and apply patches once available.