A heap buffer overflow occurs in the set_type4_frame_classifier function of Android’s sta_iface.cpp. The CVE description does not specify the exact conditions that trigger the overflow, but indicates that a local attacker can elevate privileges by exploiting the buffer overrun. No user interaction is required; once the vulnerable code is executed, the exploit can be performed. Based on the description, it is inferred that the function can be invoked without user action once the code runs.

This vulnerability affects Google Android devices. No specific Android release versions or firmware build numbers are provided in the advisory, so all releases that include the vulnerable sta_iface.cpp implementation are potentially exposed.

The CVSS score is not available and the EPSS score is not provided. The known local privilege escalation via a heap buffer overflow suggests a high severity. The vulnerability is not listed in CISA’s KEV catalog, meaning no confirmed exploits are known in the wild as of the data provided. The exact attack vector is not disclosed; the CVE does not describe the conditions that trigger the buffer overrun, so the precise method for exploitation remains unclear. However, no user interaction is required, implying that exploitation could occur automatically once the vulnerable code runs.