In the RTP packet decoder within the Android OS, an integer overflow can cause an out‑of‑bounds memory read. This flaw is a classic buffer read issue (CWE‑125) that can be abused to obtain read capabilities with local user context (CWE‑190). The vulnerability does not provide arbitrary code execution; instead, it allows a malicious process to elevate its privileges to match the highest available group on the device. No additional privileges are required, and the exploit does not involve remote components. The formal description specifies that user interaction is necessary to trigger the overflow, implying that an attacker must persuade a victim to run a crafted packet or application.

Google Android devices are the affected platform. The CVE entry does not list specific Android releases or product sub‑models. Consequently, any Android system that incorporates the vulnerable RTP packet decoder component may be impacted. Updates that include remedial code in the decoder are expected to mitigate the issue.

The CVSS score of 7.3 indicates a high severity in terms of confidentiality, integrity, and availability impact. The EPSS score of less than 1% suggests that, as of the latest statistical analysis, the probability of exploitation is very low. The vulnerability is not in the CISA Known Exploited Vulnerabilities list (KEV), meaning no publicly documented exploit campaigns are currently highlighted. The attack path lies within the local device context and requires the victim to interact with a maliciously crafted RTP packet, typically delivered via voice or video streaming services or applications that use RTP. If such user interaction occurs, the integer overflow can be triggered, leading to local privilege escalation without further exploitation steps.