A critical vulnerability in the Android kernel could allow a local attacker to escalate privileges without requiring user interaction.

The vulnerability is an out of bounds write flaw located in the WAVES_send_data_to_dsp function within libaoc_waves.c. An attacker with local access can trigger this memory corruption to achieve privilege escalation, requiring no specific user interaction.

The ability to escalate privileges locally poses a severe risk to device integrity and user data confidentiality. An attacker who has gained low-privileged access to a device could leverage this flaw to execute code with higher privileges, effectively bypassing the Android security model. With a CVSS score of 7.8, this vulnerability is classified as High severity and warrants prompt attention to prevent unauthorized system control.

Immediate Action: Apply the latest security updates provided by Google via the December 2025 Android Security Bulletin.

Proactive Monitoring: Monitor system logs for unusual kernel activity or unexpected process crashes that may indicate exploitation attempts.

Compensating Controls: Ensure that device management policies restrict the installation of unauthorized applications, as local execution is a prerequisite for this exploit.

Public Exploit Available: No (exploit_available: false)

Given the potential for local privilege escalation, organizations and users should prioritize the deployment of the December 2025 Android security patches. While the attack vector is local, the impact on system security is significant, and updating the kernel remains the only effective method to mitigate this memory corruption vulnerability.