In the Android source file cn_NrSmMsgHdlrFromMM.cpp, a memory corruption issue exists in the MM_DATA_IND routine that can be exploited to bypass the end‑of‑process (EoP) check. This flaw allows an attacker to obtain escalated privileges on the device without needing any additional execution rights. The vulnerability is a classic buffer overflow (CWE-120). Since the flaw occurs during normal message handling, it may be triggered by external input without any user interaction.

The vulnerability is present in the Google Android operating system. No version information was provided, so all releases that include the affected code path are potentially impacted. Devices running Android variants that include the cn_NrSmMsgHdlrFromMM.cpp component are at risk.

The score of 9.8 on the CVSS scale indicates a high severity level for privilege escalation. The EPSS value, rated below 1%, indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The attack vector, while not directly stated, is inferred to be remote as the flaw can be triggered by an attacker sending crafted messages to the vulnerable component, with no user interaction required.