The flaw exists in the vpu_mmap function of vpu_ioctl, where a bounds check is omitted, allowing a process to request an mmap to an arbitrary physical address. An attacker who can invoke this ioctl can therefore map privileged memory into the process address space, which in turn can be leveraged to gain local escalation of privilege without the need for additional execution privileges. The vulnerability is a classic out‑of‑bounds memory access problem classified as CWE‑119, CWE‑125, and CWE‑787.

The issue affects Android systems manufactured or maintained by Google. No specific version information is listed in the CNA data, so all Android releases that have not yet applied the fix are potentially vulnerable.

With a CVSS score of 9.3 the technical severity is high. The EPSS score is reported as less than 1%, indicating that, as of now, the likelihood of exploitation is considered very low. The vulnerability is not present in the CISA KEV catalog. Exploitation requires local access to the device and the ability to invoke vpu_ioctl, and user interaction is not required, meaning a malicious application or system process could trigger the flaw directly.