CVE-2023-40078: Buffer Overflow
Published Dec 4, 2023
·Updated
In a2dpvendoropusdecoderdecodepacket of a2dpvendoropusdecoder.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to paired device escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
2 affected components
Google Android
Google Android=14.0
Remediation
Patch Available
Event History
Dec 4, 2023
CVE Published
via Android·12:00 AM
CVE Published
via MITRE·10:40 PM
Data Sourced
via MITRE·10:40 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2023-40078.
2
What is the severity of CVE-2023-40078?
The severity of CVE-2023-40078 is high with a severity value of 7.
3
What is the affected software?
The affected software is Google Android.
4
How does the vulnerability CVE-2023-40078 work?
The vulnerability CVE-2023-40078 is a heap buffer overflow in a2dp_vendor_opus_decoder_decode_packet of a2dp_vendor_opus_decoder.cc, allowing for a possible out of bounds write and potential escalation of privilege on paired devices.
5
Is user interaction required for exploitation of CVE-2023-40078?
No, user interaction is not needed for exploitation of CVE-2023-40078.