A memory safety flaw stemming from a use‑after‑free condition is disclosed in several parts of the Android operating system. The flaw could allow attackers to execute arbitrary code with the same privileges as the affected process, thereby creating a full remote code execution vector. No additional privileges are required and the flaw requires no user interaction, meaning that an attacker could trigger the condition from outside the device with sufficient network access or by supplying mal‑crafted data to an exposed service.

Android devices built on Google’s Android platform are impacted. The CNA lists only the vendor and product; specific affected OS releases or build identifiers are not provided.

Because the flaw is a use‑after‑free, it is likely exploitable remotely via crafted input or a malicious app. The CVSS score is not listed, and the EPSS value is unavailable, so the exact likelihood of exploitation could not be quantified. The issue is not included in CISA’s KEV catalog. Attacks would not need any user interaction and could occur from any network context that can reach the vulnerable component.