The vulnerability is a missing bounds check that permits an out‑of‑bounds write. This flaw can be abused to overwrite arbitrary data and trigger remote code execution without needing elevated privileges or user interaction.

The flaw is present in Android operating systems distributed by Google. The affected model(s) or OS versions are not specified in the advisory, so all installed Android devices from the same release that contain the code paths present remain potentially vulnerable.

The risk is high because the flaw leads to remote code execution. However, the EPSS score is below 1 percent and the vulnerability is not listed in the CISA KEV catalog, indicating that active exploitation is currently rare. Attackers are likely able to exploit the issue through network or local interfaces that can invoke the vulnerable API without any user interaction, making it a silent, high‑impact threat.