There is an out‑of‑bounds write error caused by an incorrect bounds check in multiple places of the Android system. Exploiting the flaw allows a local attacker to overwrite adjacent memory, potentially modifying program state and gaining higher privileges. The attacker does not need to run arbitrary code and does not require user interaction, making the vulnerability suitable for local escalation of privilege on the device.

The identified affected product is Google Android. No specific version ranges are listed, so any Android installation that contains the affected code paths is potentially vulnerable until a patch is applied.

The CVSS score is 7.8, but the out‑of‑bounds write can yield full local privilege escalation on the target device. EPSS is not available and the issue is not in the CISA KEV catalog at this time, indicating no publicly known exploits yet. The vulnerability likely requires local access to the device; once compromised, an attacker can issue privileged actions that previously required higher privileges.