CVE-2021-39804: Null Pointer Dereference

Published Apr 4, 2022

Updated

In reinit of HeifDecoderImpl.cpp, there is a possible crash due to a missing null check. This could lead to remote persistent denial of service in the file picker with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12LAndroid ID: A-215002587

Affected Software

4 affected components

Google Android=11.0

Google Android=12.0

Google Android=12.1

Google Android

Remediation

Patch Available

https://source.android.com/security/bulletin/2022-04-01

Event History

Apr 4, 2022

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Apr 12, 2022

CVE Published

via MITRE·04:11 PM

Data Sourced

via MITRE·04:11 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2021-39804?

CVE-2021-39804 has been classified as a medium severity vulnerability due to its potential for remote persistent denial of service.

How do I fix CVE-2021-39804?

To fix CVE-2021-39804, ensure that you update your Android device to the latest version released by Google that addresses this vulnerability.

What versions of Android are affected by CVE-2021-39804?

CVE-2021-39804 affects Android versions 11.0, 12.0, and 12.1.

What type of attack does CVE-2021-39804 enable?

CVE-2021-39804 enables a possible crash that can lead to remote persistent denial of service through user interaction.

Is user interaction required for exploiting CVE-2021-39804?

Yes, user interaction is required to exploit the vulnerability identified as CVE-2021-39804.