The vulnerability resides in the rw_ci_data_cback function within rw_ci.cc, where an integer underflow can occur during data processing. This flaw can lead to a memory safety issue that allows an attacker to read data from memory that they should not have access to, resulting in remote information disclosure. Reported as a memory safety bug, the flaw does not require the attacker to have elevated privileges, nor does it demand any user interaction.

Affected products include Google's Android operating system. No specific product or version details are provided in the CVE entry, so the vulnerability could potentially impact any Android installation that contains the vulnerable rw_ci.cc component.

The CVSS score is not listed, and the EPSS score is unavailable, but the vulnerability is classified as a remote information disclosure with no privilege escalation or user interaction. Because remote exploitation is possible, the risk can be considered significant for devices that accept untrusted data streams or services that invoke the affected callback. The lack of a KEV listing suggests it has not been confirmed in the wild, yet the nature of the flaw warrants monitoring and prompt patching.