The vulnerability is an out‑of‑bounds write in the camera_metadata.c file, caused by a logical bug flaw does not require additional execution rights or user interaction; it allows local privilege escalation when the device processes camera metadata. The effect is elevated system rights for the compromised user or application, potentially exposing sensitive data or allowing further malicious actions.

The issue is present in Android devices running the Google Android operating system, affecting the camera framework’s metadata handling logic. The vulnerability applies to all releases before the security update included bulletin; specific version numbers are not listed in the data provided.

The CVSS score of 7.8 assigns high severity to this local privilege escalation vulnerability. Exploitation requires only local access and no additional execution privileges; user interaction is not required. An attacker who can run code on the device can influence the camera framework to trigger the out‑of‑bounds write in validate_camera_metadata_structure, potentially gaining system privileges. The EPSS score indicates a very low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog.