An integer overflow condition permits an out‑of‑bounds memory write, enabling a local user to gain elevated privileges without executing additional code. The vulnerability does not rely on user interaction and does not require remote access, meaning a malicious application or locally compromised code can trigger the exploit.

The flaw is present in Google Android operating systems; specific versions are not listed, so all Android releases that contain the vulnerable code paths are potentially impacted.

The CVSS score of 8.4 indicates a high severity, while the EPSS score is below 1%, showing a very low exploitation probability. The vulnerability is listed as not included in the CISA KEV catalog. Because the attack vector is local and user interaction is unnecessary, a malicious app or locally running code could activate the integer overflow to write beyond buffer bounds and elevate privileges, posing a significant risk to device security.