The vulnerability resides in the __mfc_core_nal_q_get_dec_metadata_sei_nal function in mfc_core_nal_q.c, where a missing bounds check allows an out‑of‑bounds write that can be leveraged to execute arbitrary code. No additional privileges are required, and exploitation does not require user interaction.

The flaw affects Android devices running the affected Media Codec library, as identified by Google in the Android security bulletin for the 2026‑06‑01 release. Specific OS versions are not listed, but any device that incorporates the vulnerable function is potentially impacted.

With a CVSS score of 8.8 the vulnerability is classified as high severity, yet the EPSS score of less than 1 % indicates a very low likelihood of current exploitation. The flaw is not yet listed in the CISA KEV catalog. The likely attack vector is remote, based on malformed media data processed by the system’s codec routines, and requires no user interaction.