The flaw resides in several functions within MessageQueueBase.h where an incorrect bounds check allows an out‑of‑bounds read. This defect permits a local user to read data beyond the intended buffer boundaries, potentially exposing privileged information and enabling elevation of privileges without requiring additional execution rights. No user interaction is needed for exploitation; the attacker only needs local access to the affected system.

Google Android operating systems are impacted. The specific Android releases affected are not enumerated in the advisory, so any installation of Android that contains the vulnerable MessageQueueBase implementation may be susceptible.

Based on the CVSS score of 7.8, the vulnerability is considered moderate in severity. EPSS is not available, so the exact exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV inventory, indicating no known widespread exploits at the time of this report. Nevertheless, the local privilege escalation potential combined with a zero‑interaction attack vector suggests a moderate to high risk for any device running the affected Android code.