A flaw in Android’s modem component allows an out‑of‑bounds write when a malformed packet bypasses an incorrect bounds check. The vulnerability falls under CWE‑787 and can be leveraged to execute arbitrary code on the device without needing elevation of privileges or user interaction. This means an attacker could compromise device security, steal data, or persist malware on the system.

The issue affects Google Android devices, as documented by the Android Security Bulletin for the March 2026 release. The exact versions impacted are those included in the March 2026 bulletin, but the statement does not enumerate specific Android releases. Devices running pre‑patched firmware that includes the modem code revision preceding the fix are vulnerable.

The CVSS score of 9.8 classifies this as critical; however, the EPSS score is reported as less than 1 %, indicating a low probability of exploitation within the broader threat landscape. The vulnerability is not listed in the CISA KEV catalog. The exploit requires no user interaction and can be triggered remotely through crafted network traffic, making it a high‑impact threat for devices still running affected firmware.