In Android 16.0, multiple code paths can trigger a heap buffer overflow, resulting in out‑of‑bounds reads and writes. The flaw can be exploited by a remote attacker to execute arbitrary code without needing elevated privileges, and the attack does not require any action from the device user.

Google Android 16.0 devices are affected. The vulnerability is present in the core operating system, so all devices running this version (or any earlier unpatched releases containing the same code) are at risk.

The flaw carries a CVSS score of 9.8, indicating critical severity, with an EPSS score of less than 1% – exploitation is possible but rare in the wild. Not listed in the CISA Known Exploited Vulnerabilities catalog, the vulnerability remains a high‑risk target for attackers exploiting remote code execution with no user interaction.