VULNERABILITY INTELLIGENCE

CVE-2018-9594

CVSS score6.5 MEDIUM

EPSS probability0.33%

CISA KEVNot currently listed

Published2019-02-11

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

In llcp_link_proc_agf_pdu of llcp_link.cc in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure over NFC with no additional execution privileges needed. User interaction is not needed for exploitation. Android ID: A-116791157.

Weakness classification

CWE-125: Out-of-bounds Read
CWE-190: Integer Overflow or Wraparound

Primary references

security@android.com — Third Party Advisory, VDB Entry
security@android.com — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory