An out‑of‑bounds write occurs in the ReadTileInfo function of vp9hwd_headers.cc, allowing an attacker to elevate privileges on an Android device without needing additional execution rights. The flaw is a bounds‑checking bypass (CWE‑787) that can be triggered by feeding malformed tile data to the VP9 hardware decoder. The result is an unauthorized privilege escalation that can give the attacker full control over the device.

The CVE affects Google’s Android operating system within the VP9 hardware video decoding path, as referenced in the Pixel security bulletin of September 2026. Devices running the affected Android release, regardless of specific model or OS version, are potentially vulnerable if they include the unpatched vp9hwd_headers.cc file. All installations that use the VP9 hardware decoder are at risk.

The flaw carries a CVSS score of 8.8 and is not currently listed in the CISA KEV catalog. The EPSS score of less than 1% indicates a very low but non‑zero likelihood of exploitation, yet the lack of user interaction suggests remote exploitation is feasible. The likely attack vector, based on the description, is that a remote actor can supply crafted tile data to the hardware decoder and trigger the out‑of‑bounds write, thereby gaining elevated privileges. Given the high severity and ease of exploitation, the risk to affected devices is substantial.