CVE-2018-9524

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In functionality implemented in System UI, there are insufficient protections implemented around overlay windows. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1. Android ID: A-34170870

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1021

Affected software

VendorProductVersions
Google Inc.AndroidAndroid-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1

References

Timeline

Published
Nov 14, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-95257.8In the AndroidManifest.xml file defining the SliceBroadcastReceiver handler for com.android.settings.slice.action.WIFI_CHANGED, there is a pCVE-2018-95267.5In device configuration data, there is an improperly configured setting. This could lead to remote disclosure of device location. User interCVE-2018-95277.8In vorbis_book_decodev_set of codebook.c there is a possible out of bounds write due to missing bounds check. This could lead to remote codeCVE-2018-95288.8In ixheaacd_over_lap_add1_armv8 of ixheaacd_overlap_add1.s there is a possible out of bounds write due to a missing bounds check. This couldCVE-2018-95298.8In ixheaacd_individual_ch_stream of ixheaacd_channel.c there is a possible out of bounds write due to a missing bounds check. This could leaCVE-2018-95308.8In ixheaacd_tns_ar_filter_dec of ixheaacd_aac_tns.c there is a possible out of bounds write due to a missing bounds check. This could lead tCVE-2018-95317.8In AudioSpecificConfig_Parse of tpdec_asc.cpp, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remCVE-2018-95328.8In ixheaacd_extract_frame_info_ld of ixheaacd_env_extr.c there is a possible out of bounds write due to a missing bounds check. This could lCVE-2018-95338.8In ixheaacd_dec_data_init of ixheaacd_create.c there is a possible out of write read due to a missing bounds check. This could lead to remotCVE-2018-95348.8In ixheaacd_mps_getstridemap of ixheaacd_mps_parse.c there is a possible out of bounds write due to a missing bounds check. This could lead CVE-2018-95358.8In ixheaacd_reset_acelp_data_fix of ixheaacd_lpc.c there is a possible out of bounds write due to a missing bounds check. This could lead toCVE-2018-95367.8In numerous functions of libFDK, there are possible out of bounds writes due to incorrect bounds checks. This could lead to remote code exec
CVE-2018-9524: High severity, CVSS 7.8 | Vulnix