In the Android framework, a bug in the parseParts function of PduParser.java can cause a heap buffer out‑of‑bounds read. This flaw allows a local attacker to read memory beyond the intended bounds, leading to a privilege escalation on the device. No additional execution privileges or user interaction are required, enabling the attacker to perform malicious actions with a higher privilege level.

The vulnerability is linked to Android operating systems distributed by Google. No specific Android releases or build numbers are enumerated in the entry, so all devices that include the affected PduParser code are potentially impacted until the vendor releases a patched build.

The CVSS score of 7.8 indicates high severity, and the EPSS score is not available, but the lack of user interaction and the local nature of the impact make exploitation relatively straightforward for an attacker who already has physical or local access to the device. The vulnerability is not listed in the CISA KEV catalog, which suggests no confirmed public exploits yet. The likely attack vector is a local adversary who can trigger packet parsing within the system or a compromised application that can invoke PduParser. The combination of the vulnerable buffer manipulation (CWE‑122) and the local privilege escalation potential makes this a significant concern for devices running the affected Android code.