This vulnerability involves an out-of-bounds read in the RTCP packet decoder component of Google Android due to missing bounds checks in multiple functions. This flaw can be exploited remotely to disclose information without needing elevated execution privileges. User interaction is necessary for exploitation. No CVSS score or vendor remediation details are currently available.

An attacker could remotely cause the affected Android device to disclose information due to out-of-bounds memory reads in the RTCP packet decoder. The attacker does not require additional execution privileges, but user interaction is required to trigger the vulnerability. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with untrusted RTCP packets and avoid interacting with suspicious content that might trigger this vulnerability.