This vulnerability involves an out-of-bounds write in the libcodec2secqcelpdec.so component before the SMR Aug-2026 Release 1. Local attackers with low privileges can exploit this flaw to write outside the allocated memory bounds, which may result in arbitrary code execution or system compromise. The CVSS vector indicates low attack complexity and no user interaction required, with high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to complete compromise of the affected system's confidentiality, integrity, and availability due to out-of-bounds memory writes. The attacker must have local access with low privileges. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, restrict local access to trusted users only to reduce risk.