A high-severity local privilege escalation vulnerability in the Android DevicePolicyManagerService could allow a local attacker to gain elevated system permissions.

The vulnerability exists in the saveGlobalProxyLocked method of the DevicePolicyManagerService.java file, where a logic error permits a desync from persistence, enabling an attacker with low privileges to escalate their access level without user interaction.

Successful exploitation allows a local user to bypass security controls and gain escalated privileges on the affected device, potentially leading to unauthorized data access, modification, or full system control. With a CVSS score of 7.8, this flaw represents a significant risk to the integrity and confidentiality of the device, particularly in enterprise environments where Android devices are managed via mobile device management policies.

Immediate Action: Update affected Android devices to the latest security patch level as specified in the September 2025 Android Security Bulletin.

Proactive Monitoring: Monitor system logs for unexpected modifications to device policy configurations or abnormal process execution patterns originating from local user accounts.

Compensating Controls: Implement strict device management policies and restrict the installation of unauthorized applications to minimize the risk of a malicious local actor triggering this exploit.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Given the potential for local privilege escalation, organizations should prioritize the deployment of the September 2025 security updates to all managed Android handsets. Failure to patch these devices leaves them vulnerable to local exploitation, which could compromise the entire security posture of the mobile fleet.