In the Android camera subsystem, the function returnOutputBufferLocked in DeprecatedCamera3StreamSplitter.cpp omits a required bounds check, leading to an out‑of‑bounds read. The flaw can expose sensitive memory contents to any local process that can trigger the camera routing code, without requiring additional privileges or user interaction. Based on the description, it is inferred that an attacker must have local access to the device and be able to invoke the camera subsystem to exploit the vulnerability. The resulting data leakage poses a confidentiality risk but does not allow code execution or privilege escalation.

The defect resides in Google’s Android platform, affecting the camera stream splitting component that uses DeprecatedCamera3StreamSplitter.cpp. Since no specific device or OS version range is documented, the vulnerability applies to all Android builds that incorporate the unpatched code, potentially including recent releases until the security patch is applied.

The likely attack vector is a local process that can invoke the camera routing logic, as inferred from the description. The CVSS base score of 3.3 indicates low overall severity, and the EPSS score is not available, suggesting limited publicly known exploitation. The vulnerability does not require user interaction or root privileges; any local attacker with access to trigger the camera subsystem could read confidential data. Although not listed in CISA’s KEV catalog, the ease of local exploitation makes it advisable to monitor for potential in malware or compromised apps.