An integer overflow in RtcpFbPacket::decodeRtcpFbPacket triggers an out‑of‑bounds read, allowing an attacker to read internal data without requiring privilege escalation. This integer overflow (CWE‑190) and out‑of‑bounds read (CWE‑125) facilitates a remote information disclosure that can be achieved by sending a crafted RTCP feedback packet; code execution or elevated privileges are not required to leak potentially sensitive data from the Android operating system.

The flaw is in the Android operating system supplied by Google. Any Android build that includes the vulnerable RtcpFbPacket implementation could be impacted. Google’s official security bulletin lists Pixel devices as a likely affected family, but other Android builds incorporating the same code may also be vulnerable. No specific version numbers are provided, so affected versions are unknown.

The CVSS score of 3.5 indicates a low impact severity, and the EPSS score of less than 1% suggests a very low likelihood of exploitation. The vulnerability requires user interaction and is not listed in the CISA KEV catalog. Exploitation would involve sending a specially crafted RTCP feedback packet that causes an integer overflow in RtcpFbPacket::decodeRtcpFbPacket, leading to an out‑of‑bounds read of internal memory. No code execution or privilege escalation is required.