The bug is an out-of-bounds read in the validateImageInfo function of Bitmap.cpp. Because the code fails to verify the precondition, an attacker can read unintended memory contents. The read is performed locally; no escalation of privileges is required, and it can be triggered without any user interaction. This leads to leakage of potentially sensitive data stored in the process memory.

Google Android systems are impacted. No specific Android release or version numbers are listed in the available data, so all releases that include the vulnerable Bitmap.cpp implementation may be affected.

The CVSS score is not reported and the EPSS data is unavailable, so the exact likelihood of exploitation cannot be quantified. The vulnerability is not yet listed in CISA’s KEV catalog. Because exploitation does not require user interaction, the attack vector is likely local: an attacker would need physical or privilege access to the device to exploit the read. The lack of privileged escalation limits the potential damage to information disclosure rather than broader system compromise.