A flaw in the stpropnci_process routine of Android’s stpropnci.cc module permits an out‑of‑bounds write caused by an incorrect bounds check, which is a buffer overflow (CWE‑119). The vulnerability can be triggered without requiring user interaction and can elevate the privileges of a local attacker, granting them higher operating system rights without the need to execute additional code.

The affected product is the Android operating system from Google. No specific version or patch level information is provided in the data, so all Android installations that contain the vulnerable stpropnci.cc implementation may be impacted.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is 7.8, indicating a high severity. The lack of a user‑interaction prerequisite and the potential for privilege escalation suggest a significant risk. An attacker with local access could exploit the out‑of‑bounds write to gain elevated privileges, potentially compromising system integrity and confidentiality.