Executive brief
A logic error in Android's telephony management component allows for the unauthorized removal of carrier restrictions. This could allow a local user or malicious application to bypass cellular provider locks or escalate their system privileges without any user interaction. Such an exploit could lead to unauthorized device usage or a compromise of system integrity.
Technical details
A logic error exists within the 'setAllowedCarriers' method of 'PhoneInterfaceManager.java' in Android 17. This vulnerability allows an attacker to bypass or disable carrier-specific restrictions, which is classified as a local escalation of privilege (EoP). The attack does not require additional execution privileges or user interaction. While the CNA provided a CVSS 4.0 score of 10.0 with a network attack vector, the technical description and Android security bulletin categorize this as a local 'EoP' (Escalation of Privilege) issue. A fix is included in the Android 17 security patch level 2026-07-01.
Affected products
- Google Android 17
Timeline
- 2026-06-16: advisory: Android 17 Security Release Notes published
- 2026-06-17: disclosed: CVE published to NVD