CVE-2015-9026

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In all Android releases from CAF using the Linux kernel, an untrusted pointer dereference vulnerability exists in WideVine DRM.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-476

Affected software

VendorProductVersions
Qualcomm, Inc.All Qualcomm productsAll Android releases from CAF using the Linux kernel

References

Timeline

Published
Jun 13, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2015

CVE-2015-90277.8In all Android releases from CAF using the Linux kernel, an untrusted pointer dereference vulnerability exists in WideVine DRM.CVE-2015-90287.8In all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in a cryptographic routine.CVE-2015-90297.8In all Android releases from CAF using the Linux kernel, a vulnerability exists in the access control settings of modem memory.CVE-2015-90307.8In all Android releases from CAF using the Linux kernel, the Hypervisor API could be misused to bypass authentication.CVE-2015-90313.3In all Android releases from CAF using the Linux kernel, a TZ memory address is exposed to HLOS by HDCP.CVE-2015-90323.3In all Android releases from CAF using the Linux kernel, a DRM key was exposed to QTEE applications.CVE-2015-90337.8In all Android releases from CAF using the Linux kernel, a QTEE system call fails to validate a pointer.CVE-2015-90349.8In all Qualcomm products with Android releases from CAF using the Linux kernel, a string can fail to be null-terminated in SIP leading to a CVE-2015-90359.8In all Qualcomm products with Android releases from CAF using the Linux kernel, a memory buffer fails to be freed after it is no longer needCVE-2015-90369.8In all Qualcomm products with Android releases from CAF using the Linux kernel, an incorrect length is used to clear a memory buffer resultiCVE-2015-90379.8In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer over-read may occur in the processing of a downlinkCVE-2015-90389.8In all Qualcomm products with Android releases from CAF using the Linux kernel, a NULL pointer may be dereferenced in the front end.
CVE-2015-9026: High severity, CVSS 7.8 | Vulnix