A critical out of bounds read vulnerability in the Android Parcel component allows a local attacker to escalate privileges without requiring user interaction.

This is an out of bounds read flaw located in the Parcel.cpp component, triggered by a missing bounds check. The vulnerability allows an attacker with low privileges to achieve local escalation of privilege.

The ability for a local attacker to escalate privileges to the system level poses a severe security risk to the integrity and confidentiality of the mobile device. With a CVSS score of 7.8, this vulnerability is classified as High severity, as it enables unauthorized access to sensitive application data and system functions that are typically restricted from standard user accounts.

Immediate Action: Update all affected Android devices to the latest security patch level provided by the manufacturer as specified in the December 2025 Android Security Bulletin.

Proactive Monitoring: Monitor device performance and security logs for unexpected process crashes or unauthorized attempts to access system-level services.

Compensating Controls: Ensure that third-party application installations are restricted to verified sources and implement mobile device management (MDM) policies to enforce current security patch levels.

Public Exploit Available: Unknown

This vulnerability represents a significant risk to the Android ecosystem, allowing for unauthorized privilege escalation. Administrators and end users should prioritize the application of the December 2025 security updates to address the missing bounds check in Parcel.cpp and prevent potential exploitation.