The vulnerability is a missing bounds check in the RtcpHeader::decodeRtcpHeader function of the Android RTCP stack. This omission allows a crafted RTCP packet to read memory beyond the intended bounds, potentially leaking sensitive data stored in nearby memory. The flaw results in remote information disclosure without requiring elevated privileges or additional execution rights. The weakness relates to malformed input handling, specifically a buffer overread identified by CWE-120 and CWE-125.

The affected product is Google Android on Pixel devices. The vulnerability is present in the Android Runtime components that handle RTCP (Real‑time Transport Control Protocol) packets. The specific versions affected are not detailed in the information provided, so any Android build using the current RTCP header decoding code is potentially vulnerable.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% suggests low likelihood of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is remote, network‑based, leveraging malicious RTCP packets. Successful exploitation requires only the ability to send crafted RTCP traffic to the device and does not depend on user interaction. The impact is the disclosure of confidential memory contents to the attacker, which could aid in further attacks or compromise confidentiality.