A missing bounds check in the writeAocCommand function of AocAudioCodec.cpp allows an attacker to send a specially crafted audio command that may overwrite memory beyond the intended buffer. This memory corruption can cause the media service to crash, resulting in a denial of service. The flaw is classified as CWE‑120 and does not grant the attacker any increased privileges; it can be triggered purely through remote input without user interaction.

This vulnerability applies to the Android operating system on Google devices that include the AocAudioCodec component. No specific build or OS version is referenced, so any Android build that contains the unpatched AocAudioCodec code is potentially affected.

The CVSS score of 7.5 reflects a high severity impact, while the EPSS score of less than 1% indicates the likelihood of exploitation is currently low. The vulnerability is not part of CISA's KEV catalog. The attack vector is inferred to be a remote interface to the audio service, where an attacker could send a malicious command to initiate the overflow. No additional privileges or user actions are required for an adversary to exploit this weakness.