The vulnerability arises in the descrambling logic for multiple files, where improper casting can lead to an out‑of‑bounds write. This flaw permits a local attacker to overwrite memory and gain higher privileges. The attack does not require additional execution privileges nor user interaction, making it potentially straightforward for a malicious app or user to exploit.

Android operating systems distributed by Google are affected. No specific version range is supplied, so all releases shipped with the flawed descrambling component may be vulnerable.

The CVSS score is not provided and the EPSS score is unavailable, so the exact quantitative risk cannot be stated. The flaw is not listed in the CISA KEV catalog, suggesting there are no publicly confirmed exploits at this time. Nonetheless, given that the bug facilitates local privilege escalation with no user interaction, the potential impact is significant if attackers can run a malicious application with user consent or malicious code already present on the device.