Google Android stores media under DRM protection in the IDrmManagerService. An error in the onTransact routine of IDrmManagerService.cpp omitted a bounds check, allowing an out‑of‑bounds write. The flaw can be triggered by a local attacker and results in escalation of privilege, enabling the attacker to achieve local root level access without needing to execute arbitrary code or perform a remote attack. No user interaction is required and no additional execution privileges are needed beyond those already available to the attacker on the device.

The vulnerability affects Android operating systems from version 14.0 up through 16.0. It is present in all builds of Google Android released in the March 2026 security bulletin, including 14.0, 15.0, and 16.0.

The CVSS score of 8.4 indicates a high severity level. EPSS is less than 1%, suggesting the exploitation rate is currently low, and the flaw is not listed in CISA’s KEV catalog. The design of the flaw allows exploitation on the victim device without user interaction, making the attack vector local. An attacker who gains the ability to run code on the device can trigger the out‑of‑bounds write, elevate privileges, and potentially bypass all device security controls. The low EPSS score, however, mitigates the immediate threat, but the high severity warrants prompt mitigation.