Android EUVD-2026-74012

Exploitation requires a malicious or compromised app installed on the target Android device - CVSS PR:L confirms low-privilege app-level access is sufficient. The vulnerable code path (COLR table processing in FreeType) is reached whenever the system renders a TrueType/OpenType font containing a COLR table, which is a standard feature used for colored emoji and layered glyph fonts. No special system configuration or non-default feature flag is required; any app capable of presenting custom font content to the system renderer can trigger the path. Exploitation is limited to local attack surface - remote unauthenticated exploitation is not possible without a prior local foothold. The SSVC Automatable: no rating indicates scalable mass exploitation without per-target interaction is not straightforward, likely due to heap-layout variability across Android versions and devices.

Real-world risk is moderate relative to raw CVSS 7.8. The local attack vector (AV:L) and requirement for PR:L (a local app with low privileges) constrain this to post-installation scenarios - an attacker cannot exploit this remotely without a prior foothold or a sideloaded/store-delivered malicious app. EPSS at 0.15% (5th percentile) and SSVC Exploitation: none both indicate no observed exploitation activity. However, SSVC Technical Impact: total aligns with the C:H/I:H/A:H vector, meaning successful exploitation yields complete compromise of the affected process or system partition. Android's attack surface for FreeType is broad - virtually any app rendering custom fonts (document viewers, messaging apps, browsers) could serve as a delivery mechanism. Automatable: no (SSVC) reflects the multi-step nature of the exploit chain. The description's mention of 'remote code execution' alongside 'local escalation of privilege' is typical Android bulletin language where the overflow capability is called RCE but the realized impact path is LPE - the CVSS AV:L is the authoritative vector. No POC has been identified at time of analysis.

An attacker publishes a malicious Android app - disguised as a document viewer or messaging client - that embeds a crafted TrueType font with a specially computed COLR table designed to trigger the integer overflow in tt_face_colr_blend_layer. When the app renders the font, FreeType's arithmetic overflow corrupts heap memory in the rendering process, which the attacker leverages to redirect execution and escalate to a system-level privilege context. No POC has been publicly identified, but the font parsing attack surface in Android is well-understood and historically exploited.