An out‑of‑bounds read occurs in the Vp9DecEndOfStream function of vp9hwd_output.cc. The incorrect bounds check allows a local attacker to read beyond the intended buffer limits, potentially exposing sensitive data or influencing program control flow. This flaw is classified as CWE‑125 and can elevate the attacker’s privilege level relative to the current user context without requiring additional execution privileges or user interaction.

Devices running Google Android that incorporate the VP9 hardware‑decoder implementation are affected. The CNA does not specify particular OS releases or hardware revisions, so any Android device using the VP9 decoder component may be at risk.

The CVSS score of 8.4 indicates a high‑severity vulnerability that can result in local privilege escalation. The EPSS score is less than 1%, suggesting a low current exploitation likelihood, and the vulnerability is not listed in the CISA KEV catalog. An attacker can supply a malicious VP9 stream via a media file or streaming application; the vulnerable decoder will perform an out‑of‑bounds read during playback, potentially leaking data or influencing program state to raise privileges.