The flaw resides in the qsort implementation in libufdt_sysdeps_vendor.c, where a resource exhaustion condition can cause an out‑of‑bounds write. This memory corruption can be leveraged to elevate privileges on the local system, allowing an attacker to gain higher privileges without first executing arbitrary code. The vulnerability does not require any user interaction and does not rely on additional execution privileges, which means that any user on the device could trigger it in principle.

Android devices manufactured by Google are affected. No specific Android releases or firmware versions are listed in the available data, so all supported Android versions that include the mentioned qsort implementation may be vulnerable.

The CVSS score of 7.8 indicates a high severity, while the EPSS score is not available. The vulnerability is not recorded in the CISA Known Exploited Vulnerabilities catalog. An attacker can trigger the exploit by exhausting system resources to drive the out‑of‑bounds write, then manipulating memory or process behavior to gain elevated permissions on the device.