The flaw resides in the isValid function of ShimConverter.cpp where a missing bounds check allows an out‑of‑bounds memory read. An attacker with local device access can capture data beyond the intended buffer, revealing sensitive information without needing elevated privileges.

Devices running Google Android are affected. The security bulletin does not list specific Android versions, so all releases prior to the patch issuance should be regarded as vulnerable until the update is applied.

The vulnerability requires local access and no special privileges, so remote exploitation is not possible. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would involve triggering ShimConverter in a way that causes the buffer over‑read, leading to information disclosure.