The vulnerability resides in the getEntryFileName function of ZipFileRO.cpp and can trigger a heap buffer overflow. This flaw allows a local attacker to gain elevated privileges on the device without requiring additional execution privileges or user interaction. The lack of any user interaction requirement further increases the risk of silent exploitation.

Google Android systems are affected by this flaw. No specific version numbers are listed in the available data, but the problem is documented in the 2026‑11‑01 Android security bulletin, implying that recent and potentially earlier Android releases are at risk.

The EPSS score is <1%, and the vulnerability is not listed in the CISA KEV catalog; however, the CVSS score of 8.4 indicates a high severity. The ability to trigger a heap buffer overflow to elevate privileges can be exploited by local code without additional attacker privileges. The lack of user interaction required means exploitation could occur simply by running code on the device or by providing a crafted ZIP file via a local vector.