The vulnerability resides in the DecodeFilmGrainParams routine within film_grain_dec.cc, where a missing bounds check permits an out-of-bounds write. This flaw does not require elevated privileges and can drive arbitrary code execution. The impact is a full compromise of the affected device, allowing an attacker to execute code with the rights of the Android user profile that runs the decoder.

Google Android devices affected by this flaw are those that implement the film grain decoder component without the necessary bounds check. Specific Android releases are not listed, but the issue applies to any version prior to the patch referenced in the Google security bulletin.

The CVSS score of 8.8 indicates high severity. The EPSS score is not available, and the issue is not yet in the CISA KEV catalog. Because user interaction is not required for exploitation, the likely attack vector is remote, such as malformed media delivered over a network or USB. An attacker could trigger the flaw by crafting a malicious file that invokes the decoder, leading to code execution without needing privileged access.