A missing bounds check in TextRtpPayloadDecoderNode::DecodeT140 of Android’s RTP payload decoding module can cause an out‑of‑bounds write. This flaw permits remote code execution without requiring escalated privileges or user interaction, enabling an attacker to run arbitrary code on the affected device.

The vulnerability affects Google Android devices. No specific version or build information is disclosed in the available data, so any Android device that incorporates the affected TextRtpPayloadDecoderNode implementation is considered at risk.

The CVSS score of 8.8 reflects a high severity, but the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild at present. The flaw is not listed in the CISA KEV catalog. Exploitation is likely to occur remotely, possibly through crafted RTP streams that are processed by the vulnerable decoder, and it does not require user interaction.