A critical heap buffer overflow vulnerability in the Android C2SoftDav1dDec component could allow an attacker to perform remote information disclosure.

This vulnerability is an out of bounds read triggered by a heap buffer overflow within the initDecoder function of C2SoftDav1dDec.cpp, which can be exploited by a remote attacker with low privileges.

The vulnerability poses a significant risk to data confidentiality by allowing unauthorized access to sensitive information stored within the memory of the affected device. Given the CVSS score of 7.5, this high severity flaw could lead to the exposure of private user data, credentials, or proprietary information, potentially resulting in severe reputational and security consequences for organizations utilizing these Android versions.

Immediate Action: Apply the December 2025 Android security updates provided by Google as soon as they become available for your specific device model.

Proactive Monitoring: Security teams should monitor system logs for unusual crashes or anomalous memory access patterns that may indicate an attempted exploitation of the decoder.

Compensating Controls: While standard mobile security controls are limited, maintaining an updated security posture and restricting unnecessary network access can reduce the potential attack surface for remote exploitation.

Public Exploit Available: No (exploit_available: false)

This vulnerability represents a significant risk to the integrity and confidentiality of Android devices running versions 15 and 16. Administrators must prioritize the deployment of the official vendor patch from Google to mitigate the risk of unauthorized information disclosure. Failure to update promptly leaves devices vulnerable to potential remote attacks targeting memory corruption flaws.