Android’s RtcpChunk::decodeRtcpChunk function can perform a buffer overread when parsing RTCP packets, allowing an adversary to read memory beyond the intended heap buffer. This out‑of‑bounds read, classified as CWE‑122 and CWE‑125, may expose internal data such as cryptographic keys or configuration settings without executing code or escalating privileges. The vulnerability is not a code‑execution flaw; it is purely an information‑disclosure issue.

The flaw affects devices running the Google Android operating system. No specific Android version range is listed in the advisory, so any supported release that implements the RtcpChunk::decodeRtcpChunk routine may be susceptible.

The CVSS score of 4.3 places the vulnerability in the low‑severity range. The EPSS score of less than 1% indicates a very small current exploitation probability, and the flaw is not cataloged in the CISA KEV database. Based on the description, the likely attack vector is a remote RTCP packet crafted by an attacker; user interaction is required for exploitation, meaning an unsuspecting user must receive a malicious payload over a network that processes RTCP traffic.