A missing bounds check in the __mfc_handle_released_buf function within mfc_core_isr.c causes an out‑of‑bounds write that can be exploited to execute arbitrary code with the privilege level of the calling process. The flaw does not require elevated privileges and can be triggered without any user interaction.

The vulnerability affects devices running Google Android. No specific versions are listed, so the impact applies broadly to all affected Android releases as noted in the March 2026 security bulletin.

The CVSS score of 9.8 classifies the vulnerability as critical. EPSS indicates a very low probability of exploitation, but the flaw remains exploitable without additional conditions, and it is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Attackers may leverage malicious media content or system calls, making it potentially reachable via remote or local vectors that do not require user involvement.