This vulnerability arises from a possible out-of-bounds write in several components of the Android operating system. The memory corruption can be exploited to execute arbitrary code without requiring elevated privileges, leading to total compromise of system confidentiality, integrity, and availability. The weakness corresponds to CWE‑787 buffer over-read/write vulnerabilities.

The flaw affects devices running the Google Android operating system. No specific sub‑versions are listed in the public data, so all releases that include the affected code paths are potentially vulnerable until updated by Google as described in the 2026‑03‑01 Security Bulletin.

The CVSS score of 8.4 indicates severe risk, while the EPSS score of less than 1% suggests that, as of the current data set, exploitation is unlikely but still possible. The vulnerability can be triggered without user interaction and therefore constitutes a remote code execution risk that can be leveraged from a local adversary or an attacker who can deliver malicious input to the affected component. Because it is not listed in CISA’s KEV catalog, there are no known widespread exploits, but the potential impact warrants a high priority response.