The vulnerability stems from an integer overflow in several Android system functions, causing a write beyond the bounds of a buffer. This out‑of‑bounds memory corruption can allow a malicious application or local user to overwrite data that is normally protected, effectively elevating its privileges on the device. Based on the description, it is inferred that the overflow leads to memory corruption that can be leveraged for local privilege escalation without the attacker needing to execute code beyond the privileges of the application.

Based on the description, it is inferred that Android devices running builds prior to the September 2026 security bulletin may be affected. This weakness affects Android devices that run versions of the operating system where the vulnerable functions are included. The advisory does not list specific Android build numbers, but it explicitly states that any Android build prior to the September 2026 security bulletin may be affected. Therefore, any device running an unpatched Android release before that date is considered affected.

Exploitation is local and does not require additional user interaction beyond installing. The EPSS score is reported as < 1 %, indicating a very low probability of exploitation; however, the CVSS score of 7.8 indicates a high severity level, so the vulnerability poses significant risk. The vulnerability is not listed in the CISA KEV catalog, suggesting that no widely known exploitation activity has been observed. It is inferred that the attack vector is local, relying on a malicious application already present on the device, but requires no further privileges beyond those initially granted to the application.