An arbitrary file overwrite flaw permits attackers to replace critical internal files during the file import process, potentially enabling remote code execution or the disclosure of sensitive data. The weakness arises from unsafe path handling (CWE‑22).

The vulnerability affects PEAKSEL D.O.O.'s NIS Animal Sounds and Ringtones for Android, version 1.3.0, and applies only to devices running that exact application version on the Android platform.

The CVSS score of 9.8 signals a severe risk, while an EPSS value below 1 % suggests a low current exploitation rate. The flaw is not listed in the KEV catalog, yet an attacker who can supply a crafted file for import could trigger arbitrary code execution. The attack likely needs user interaction to initiate the import, though unconstrained import pathways could allow remote exploitation.