CVE-2018-9521

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

In parseMPEGCCData of NuPlayer2CCDecoder.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-111874331

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Google Inc.	Android	Android-9

References

http://www.securityfocus.com/bid/105865Third Party Advisory, VDB Entry
https://source.android.com/security/bulletin/2018-11-01Patch, Vendor Advisory
http://www.securityfocus.com/bid/105865Third Party Advisory, VDB Entry
https://source.android.com/security/bulletin/2018-11-01Patch, Vendor Advisory

Timeline

Published: Nov 14, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-95227.8In the serialization functions of StatsLogEventWrapper.java, there is a possible out-of-bounds write due to unnecessary functionality which CVE-2018-95237.8In Parcel.writeMapInternal of Parcel.java, there is a possible parcel serialization/deserialization mismatch due to improper input validatio CVE-2018-95247.8In functionality implemented in System UI, there are insufficient protections implemented around overlay windows. This could lead to local e CVE-2018-95257.8In the AndroidManifest.xml file defining the SliceBroadcastReceiver handler for com.android.settings.slice.action.WIFI_CHANGED, there is a p CVE-2018-95267.5In device configuration data, there is an improperly configured setting. This could lead to remote disclosure of device location. User inter CVE-2018-95277.8In vorbis_book_decodev_set of codebook.c there is a possible out of bounds write due to missing bounds check. This could lead to remote code CVE-2018-95288.8In ixheaacd_over_lap_add1_armv8 of ixheaacd_overlap_add1.s there is a possible out of bounds write due to a missing bounds check. This could CVE-2018-95298.8In ixheaacd_individual_ch_stream of ixheaacd_channel.c there is a possible out of bounds write due to a missing bounds check. This could lea CVE-2018-95308.8In ixheaacd_tns_ar_filter_dec of ixheaacd_aac_tns.c there is a possible out of bounds write due to a missing bounds check. This could lead t CVE-2018-95317.8In AudioSpecificConfig_Parse of tpdec_asc.cpp, there is a possible out-of-bounds write due to a missing bounds check. This could lead to rem CVE-2018-95328.8In ixheaacd_extract_frame_info_ld of ixheaacd_env_extr.c there is a possible out of bounds write due to a missing bounds check. This could l CVE-2018-95338.8In ixheaacd_dec_data_init of ixheaacd_create.c there is a possible out of write read due to a missing bounds check. This could lead to remot