CVE-2018-9531: Critical severity Google Android vulnerability
In AudioSpecificConfigParse of tpdecasc.cpp, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112661641
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attack requires user interaction. The vulnerable condition is an out-of-bounds write in AudioSpecificConfig_Parse, and successful exploitation could result in remote code execution without requiring additional execution privileges.
Which Android versions are identified as affected?
The provided data identifies Android 9 as affected.
How severe is the issue?
It is rated critical with a CVSS v3.0 score of 9.3. The vector indicates low attack complexity, no privileges required, user interaction required, and high impact to confidentiality, integrity, and availability.