A heap buffer overflow in the function a2dp_vendor_opus_decoder_decode_packet within the a2dp_vendor_opus_decoder.cc source code allows an out‑of‑bounds write on the heap. This flaw can lead to local privilege escalation without requiring additional execution privileges or user interaction.

The vulnerability exists in Google Android devices that include the a2dp_vendor_op no specific Android version or build identifiers, so the flaw applies to all affected releases until a vendor patch is released.

The CVSS score of 7.8 indicates a high severity for a local privilege escalation vulnerability. The EPSS score of less than 1% suggests a very low probability of exploitation at present, and the flaw is not listed in the CISA KEV catalog. Since the vulnerability does not require user interaction or elevated privileges, an attacker who already has local device access could exploit it. The likely attack vector is that the overflow could be triggered via an A2DP audio stream that uses the affected Opus codec; based on the description, this inference is grounded in the provided information.