The flaw resides in the decryption routine of CryptoHalHidl.cpp, where a race condition can trigger a use‑after‑free. This causes the memory freed to be accessed again, allowing an attacker to execute arbitrary code without additional privileges. No user interaction is required for exploitation, meaning the vulnerability can be triggered remotely over a vulnerable channel.

This issue affects Android devices from Google. No specific OS version range is listed in the advisory, so all devices that rely on the current CryptoHal implementation are potentially impacted until an update is issued.

The CVE is not listed in the CISA KEV catalog and no EPSS score is available, indicating that exploitation activity has not been observed publicly yet. However, the nature of the flaw—remote code execution with no prerequisites—suggests a high severity. Attackers could target any exposed interface that invokes the affected decryption path, making the risk significant for all affected Android installations. Until a patch is released, the likelihood of exploitation remains uncertain but could be high if an attacker discovers a viable trigger.