The flaw is in Android’s RtpSession.cpp numberOfReportBlocks function, where an integer overflow produces an out‑of‑bounds write (CWE‑190 and CWE‑787). An attacker can exploit this from a remote source to elevate privileges without needing to execute arbitrary code first.

The issue affects Google Android devices; no specific builds or versions are cited, so any device running the affected code may be vulnerable.

With a CVSS score of 8.8 the vulnerability is considered high severity, yet the EPSS score is below 1 % and it is not listed in the CISA KEV catalog, indicating a low known exploitation probability. User interaction is not required; the likely attack vector involves sending crafted RTP traffic from a remote host to trigger the overflow and gain elevated privileges.