In Android’s memory management component, a logic error in limit reallocation can cause a use‑after‑free condition. This flaw allows a local attacker to exploit freed memory and overwrite critical data structures, elevating privileges without needing additional execution rights. The vulnerability does not require user interaction and is triggered by the normal operation of memory allocation. The primary impact is the elevation of local privileges.

The vulnerability affects the Android operating system supplied by Google. Specific build numbers are not disclosed, so any device running a susceptible Android build could be impacted.

The CVSS score is 7.8, indicating high severity. The EPSS score of < 1 % and absence from KEV suggest limited active exploitation. However, because the flaw permits local privilege escalation without additional execution privileges or user interaction, the potential impact remains significant for compromised applications. Exploitation would most likely occur via locally available malware or administrator‑level apps, increasing the risk on devices with weak containment policies.