A heap buffer overflow occurs in the onOutputReceived function of FrameDecoder.cpp. The flaw can overwrite memory outside the intended buffer bounds, enabling an attacker to inject and execute arbitrary code directly on the device. The write operation does not require elevated privileges, and no user interaction is needed, meaning the vulnerability is fully exploitable remotely and could compromise the confidentiality, integrity and availability of the system.

The vulnerability affects Android devices supplied by Google. No specific product variants or version ranges are listed in the available data, so all Android builds that include the vulnerable FrameDecoder implementation are potentially impacted. Users should check the Android Security Bulletin for the exact scope of affected releases.

The CVSS score is not provided, but the description indicates the vulnerability allows remote code execution with no prior access or user interaction. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the known exploit probability is unclear, yet the lack of mitigation steps from Google suggests that exploits could be feasible if not patched. The attack vector is inferred to be remote over network interfaces that invoke FrameDecoder, such as inter-process communication or media handling services.