An out of bounds read vulnerability in the Android kernel allows local, unprivileged attackers to escalate their privileges on affected devices.

The flaw exists in the Vp9DecEndOfStream function within the vp9hwd_output.cc source file, where an incorrect bounds check facilitates an out of bounds memory read. This vulnerability allows an attacker with local access to the system to escalate privileges without requiring user interaction or elevated execution permissions.

This vulnerability carries a CVSS score of 8.4, reflecting a high severity due to the potential for full system compromise. Successful exploitation grants an attacker administrative or system level access, which could lead to complete data exfiltration, installation of persistent malware, or unauthorized control over the mobile device.

Immediate Action: Users and administrators should apply the latest Android security updates provided by Google or the device manufacturer as soon as they become available.

Proactive Monitoring: Security teams should monitor system logs for unusual kernel activity or unexpected privilege escalation events that may indicate attempted exploitation.

Compensating Controls: Since this is a local exploit, organizations should enforce robust mobile device management (MDM) policies to restrict the installation of unauthorized applications that could act as a vector for local code execution.

Public Exploit Available: No (exploit_available: false)

Given the high CVSS score and the nature of kernel level vulnerabilities, this flaw represents a significant risk to device integrity. Organizations should prioritize the deployment of the next available monthly security patch for all managed Android devices to remediate the underlying memory bounds check error.