In ResourceTypes.cpp the setTo method performs an incorrect bounds check, allowing an attacker to read data beyond the intended array limits. This read‑out‑of‑bounds condition can expose sensitive local data to an application level attacker without requiring elevated privileges or executing arbitrary code, effectively leaking information that resides in memory. The flaw is a classic example of a buffer over‑read (CWE‑120) that violates bounds checking and leads to an information disclosure.

The flaw affects Google Android devices that run any operating system version prior to the vendor’s published fix. No specific version range is enumerated in the advisory, so administrators should treat all devices that have not yet applied the latest security patch as potentially vulnerable.

The vulnerability does not require user interaction and can be triggered by any code path that reaches the vulnerable setTo call. The CVSS score of 3.3 indicates low severity; the EPSS score is not available, and the vulnerability is not listed in CISA KEV. These factors suggest a moderate overall risk, but the potential to reveal confidential data warrants timely remediation.