A buffer over-read occurs within the decodeAppPacket function in RtcpAppPacket.cpp due to a missing bounds check, allowing an attacker to read arbitrary data from memory. This flaw can expose sensitive information without requiring elevated privileges or additional execution rights, making it a direct information disclosure vulnerability. and CWE-125 structures.

Android devices running any build that includes the affected RtcpAppPacket implementation, as distributed by Google. The exact affected versions are not enumerated in the advisory, but the common base is the Android operating system shipped by Google, specifically the Pixel line as referenced in the security bulletin.

The CVSS score of 4.3 represents moderate severity, while the EPSS score of less than 1% indicates a very low probability of exploitation at this time. It is not listed in the CISA KEV catalog. The attack can be performed remotely without user interaction, suggesting that if an attacker gains network visibility, they could potentially exploit the vulnerability, but practical success depends on additional environmental factors not detailed in the advisory.