ImsMediaBitReader::ReadByteBuffer performs an out‑of‑bounds read because it lacks a bounds check. The missing check allows an attacker to read beyond the intended buffer, exposing potentially sensitive data. This vulnerability can be triggered remotely and does not require the user to take any action or provide elevated privileges, meaning an attacker could obtain information from a device in the field.

The flaw is found in Google’s Android operating system. Specific affected versions are not listed in the advisory, so any release prior to the fix should be considered potentially vulnerable.

The CVSS score of 4.3 indicates moderate risk, and the EPSS score of less than 1 % shows a very low estimated probability of exploitation. Because the issue leads only to information disclosure and the attack does not need user interaction, the overall threat is low. The vulnerability is not recorded in CISA’s KEV catalog. Attackers would need only to target a device that can deliver malicious data to the ImMediaBitReader component, which is typically used for parsing media streams sent over network or via messages.