In mfc_core_get_dec_metadata_sei_nal of the Media Framework Core, a missing bounds check can cause an out‑of‑bounds write. This flaw can be exploited to execute arbitrary code without needing elevated privileges, impacting confidentiality and integrity at the same privilege level as the media framework.

Google Android systems that use the Media Framework Core component are affected. The issue appears in the build referenced by the 2026‑06‑01 security bulletin. Devices such as Pixel and other Android devices should verify that they have applied the latest patch for the Media Framework.

The CVSS score of 8.8 indicates high severity. The EPSS score of less than 1% suggests that exploitation in the wild is rare at present, and the flaw is not cataloged in the CISA KEV list. Based on the description, the likely attack vector is through malicious media content or a network‑stream processed by the device's media decoder, and no user interaction is required for exploitation.