Out-of-bounds write in libsavscmn prior to Android 15 allows local attackers to execute arbitrary code.