Technical impact
A heap buffer overflow occurs in RtpSession::rtpSendRtcpPacket, resulting in an out‑of‑bounds write that can be exploited to execute arbitrary code. No privilege escalation is required and user interaction is not needed. This flaw maps to CWE-122 and CWE-787.
Affected Systems
The vulnerability affects Google Android devices, as documented in the Google Android security bulletin for Pixel hardware. No specific affected OS versions are listed, so any device running Android at the time of the bulletin that includes the affected RtpSession code is potentially impacted.
Risk and Exploitability
The CVSS score of 8.8 indicates a high severity, while the EPSS score of < 1% suggests the likelihood of exploitation is currently low. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is remote and may involve sending specially crafted RTP/RTCP packets to the device, requiring no user interaction.
