In the Android kernel, an invalid bounds check was found in multiple locations. The flaw leads to potential out‑of‑bounds read and write operations, allowing a local attacker to read or modify sensitive memory without needing additional execution privileges. The vulnerability can be exploited without user interaction, providing a direct path for local privilege escalation.

Google Android devices that run on kernel versions containing the unchecked bounds logic are vulnerable. Because the affected code resides in the common kernel layer, all Android devices relying on that code path without a subsequent patch are susceptible. The CVE does not specify impacted releases, so any device up to the latest patched kernel should be considered potentially affected until updates are applied.

The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, but the CVSS score of 8.4 indicates a high potential for local privilege escalation. Since the attack requires only local access and no user interaction, it is considered highly exploitable in environments where malicious local code can run. Administrators should treat this as a high‑risk issue that could compromise device integrity and other user data if exploited.