An out-of-bounds read occurs in the decode_packed_entry_number function of Android's codebook.c, caused by a logic error. This allows an attacker to read memory beyond the intended buffer, exposing raw memory contents. The resulting information disclosure can reveal sensitive data such as cryptographic keys, user data, or system configuration, without requiring any privileged execution rights. The flaw does not require user interaction to be triggered, making it a remote disclosure vector.

The vulnerability affects Google Android installations that include the unpatched implementation of codebook.c. No specific version numbers are identified in the advisory, but the issue is present in all builds prior to the November 2026 security bulletin that addresses the fix. Since the vendor is Google:Android, any device running a non‑patched Android firmware is potentially exposed.

The vulnerability permits remote disclosure of memory contents; no execution privileges are needed. Because user interaction is not required, an attacker could craft payloads over a network or through other remote interfaces. The EPSS score is not published, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widely known exploits as of the advisory. Nonetheless, the severity of the information exposed could be high, warranting prompt remediation. The most likely attack vector would be a network‑based exploit that triggers the vulnerable function without user involvement.