CVE-2019-2046: Integer Overflow

Published May 6, 2019

Updated

In CalculateInstanceSizeForDerivedClass of objects.cc, there is possible memory corruption due to an integer overflow. This could lead to remote code execution in the proxy auto-config with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9 Android ID: A-117556220

Affected Software

7 affected components

Google Android=7.0

Google Android=7.1.1

Google Android=7.1.2

Google Android=8.0

Google Android=8.1

Google Android=9.0

Google Android

Event History

May 6, 2019

CVE Published

via Android·12:00 AM

May 8, 2019

CVE Published

via MITRE·04:25 PM

Data Sourced

via MITRE·04:25 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2019-2046?

CVE-2019-2046 has a critical severity rating due to its potential to allow remote code execution.

How can I fix CVE-2019-2046?

To fix CVE-2019-2046, update your Android device to a patched version of the operating system.

What versions of Android are affected by CVE-2019-2046?

CVE-2019-2046 affects Android versions 7.0, 7.1.1, 7.1.2, 8.0, 8.1, and 9.0.

Is user interaction required for the exploitation of CVE-2019-2046?

No, user interaction is not required to exploit CVE-2019-2046.

What type of attack does CVE-2019-2046 enable?

CVE-2019-2046 enables remote code execution attacks without the need for additional privileges.