The vulnerability is an out-of-bounds write caused by a_frm_prepare within oapv.c. The overflow can allow an attacker to overwrite arbitrary memory locations on the heap, potentially enabling the execution of malicious code. The description states that no additional privileges are required and that user interaction is not necessary, which indicates that execution can be performed remotely without the victim's cooperation.

Affected products are all Android devices provided by Google that include the oapv.c component in their system libraries. Exact version numbers are not supplied in the advisory, so any device running the vulnerable Android release can be impacted.

The CVSS score of 8.8 indicates a high severity flaw, while the EPSS score of <1% indicates a low probability of exploitation. The lack of a KEV listing means no confirmed exploitation is recorded at this time, but the nature of the heap overflow and the fact that it leads to remote code execution without user interaction represent a high-risk flaw. Attackers could trigger the overflow by delivering crafted data to the vulnerable module, making the vulnerability exploitable from a remote context once the data reaches the vulnerable function.