The vulnerability exists in the mfc_core_get_dec_metadata_sei_nal function within the mfc_core_reg_api.c component of Google Android. A missing bounds check allows an out-of-bounds write, which could be exploited remotely to execute arbitrary code. No user interaction or elevated privileges are needed for exploitation. No patch or remediation information is currently available, and no known exploits in the wild have been reported.

Successful exploitation could allow an attacker to execute arbitrary code remotely on affected Android devices without requiring user interaction or additional privileges, potentially leading to full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor vendor communications for updates.