In the Android media framework, the mfc_dec_dqbuf routine in mfc_dec_v4l2.c contains an incorrect bounds check that can lead to an out‑of‑bounds write. The flaw allows a local user to corrupt internal memory structures and can be used to gain system privileges without requiring additional execution rights or user interaction.

All devices running the affected Android platform, specifically those incorporating the Media Foundation Codec (MFC) decoder present in the versions covered by the bug. The vendor notes the issue affects the Android operating system, so any Android device using the unpatched framework is potentially impacted.

The vulnerability receives a high CVSS score of 8.4 and an EPSS score of less than 1%, indicating a low probability of widespread exploitation at present. It is not listed in CISA’s KEV catalog, but the severity of the local privilege escalation makes it a critical issue for devices that cannot be rapidly updated. The flaw can be leveraged by an attacker who can run code on the device, for example via a malicious application or exploited local context, to gain elevated privileges without the need for additional privilege escalation steps.