In the RtcpFbPacket::decodeRtcpFbPacket function an integer overflow allows a crafted RTCP feedback packet to cause the program to read beyond the bounds of an allocated buffer. The out‑of‑bounds read can expose internal data to the attacker, providing remote information disclosure but not granting any additional execution privileges. No code execution or elevation of privileges is required for the attack to succeed.

The affected product is Google Android, most likely on Pixel devices, as noted by the security bulletin reference. Specific version information is not provided in the CVE data, so any Android build that includes the vulnerable RtcpFbPacket implementation could be impacted.

The CVSS score is not listed, but the EPSS score of less than 1% suggests a very low probability of exploitation on the current date. The vulnerability is not listed in CISA's KEV catalog. An attacker would need to send a malicious RTCP feedback packet under user interaction, meaning the user must open or interact with a communication channel that processes the packet. The attack could be performed remotely over the network, but requires the user to be engaged in a session that uses the vulnerable component, making the threat moderate but low in likelihood.