CVE-2019-2109

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

In MakeMPEG4VideoCodecSpecificData of AVIExtractor.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1. Android ID: A-130651570.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Jul 8, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-21105.5In ScreenRotationAnimation of ScreenRotationAnimation.java, there is a possible capture of a secure screen due to a missing permission checkCVE-2019-21119.8In loop of DnsTlsSocket.cpp, there is a possible heap memory corruption due to a use after free. This could lead to remote code execution inCVE-2019-21127.8In several functions of alarm.cc, there is possible memory corruption due to a use after free. This could lead to local code execution with CVE-2019-21135.5In setup wizard there is a bypass of some checks when wifi connection is skipped. This could lead to factory reset protection bypass with noCVE-2019-21147.8In the default privileges of NFC, there is a possible local bypass of user interaction requirements on package installation due to a defaultCVE-2019-21157.8In GateKeeper::MintAuthToken of gatekeeper.cpp in Android 7.1.1, 7.1.2, 8.0, 8.1 and 9, there is possible memory corruption due to a double CVE-2019-21167.5In save_attr_seq of sdp_discovery.cc, there is a possible out-of-bound read due to a missing bounds check. This could lead to remote informaCVE-2019-21175.5In checkQueryPermission of TelephonyProvider.java, there is a possible disclosure of secure data due to a missing permission check. This couCVE-2019-21185.5In various functions of Parcel.cpp, there are uninitialized or partially initialized stack variables. These could lead to local information CVE-2019-21195.5In multiple functions of key_store_service.cpp, there is a possible Information Disclosure due to improper locking. This could lead to localCVE-2019-21207.8In OatFileAssistant::GenerateOatFile of oat_file_assistant.cc, there is a possible file corruption issue due to an insecure default value. TCVE-2019-21217.0In ActivityManagerService.attachApplication of ActivityManagerService, there is a possible race condition. This could lead to local escalati
CVE-2019-2109: High severity, CVSS 8.8 | Vulnix