CVE-2017-0637

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process.Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34064500.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

No affected versions have been published.

Timeline

Published: Jun 14, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-06387.8A remote code execution vulnerability in System UI component could enable an attacker using a specially crafted file to execute arbitrary co CVE-2017-06395.5An information disclosure vulnerability in Bluetooth component could enable a local malicious application to access data outside of its perm CVE-2017-06405.5A remote denial of service vulnerability in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or r CVE-2017-06415.5A remote denial of service vulnerability in libvpx in Mediaserver could enable an attacker to use a specially crafted file to cause a device CVE-2017-06425.5A remote denial of service vulnerability in libhevc in Mediaserver could enable an attacker to use a specially crafted file to cause a devic CVE-2017-06435.5A remote denial of service vulnerability in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or r CVE-2017-06445.5A remote denial of service vulnerability in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or r CVE-2017-06455.5An elevation of privilege vulnerability in Bluetooth could enable a local malicious application to access data outside of its permission lev CVE-2017-06465.5An information disclosure vulnerability in Bluetooth component could enable a local malicious application to access data outside of its perm CVE-2017-06475.5An information disclosure vulnerability in libziparchive could enable a local malicious application to access data outside of its permission CVE-2017-06487.8An elevation of privilege vulnerability in the kernel FIQ debugger could enable a local malicious application to execute arbitrary code with CVE-2017-06497.0An elevation of privilege vulnerability in the MediaTek sound driver could enable a local malicious application to execute arbitrary code wi