CVE-2019-2215

HighCVSS 7.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.Product: AndroidAndroid ID: A-141720095

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published: Oct 11, 2019
Last modified: Jun 17, 2026
Added to CISA KEV: Nov 3, 2021
NVD status: Analyzed

Related CVEs from 2019

CVE-2019-22167.3In overlay notifications, there is a possible hidden notification due to improper input validation. This could lead to a local escalation of CVE-2019-22177.8In setCpuVulkanInUse of GpuStats.cpp, there is possible memory corruption due to a use after free. This could lead to local escalation of pr CVE-2019-22187.8In createSessionInternal of PackageInstallerService.java, there is a possible improper permission grant due to a missing permission check. T CVE-2019-22194.7In several functions of NotificationManagerService.java and related files, there is a possible way to record audio from the background witho CVE-2019-22205.5In checkOperation of AppOpsService.java, there is a possible bypass of user interaction requirements due to mishandling application suspend.CVE-2019-22217.8In hasActivityInVisibleTask of WindowProcessController.java there’s a possible bypass of user interaction requirements due to incorrect hand CVE-2019-22227.8n ihevcd_parse_slice_data of ihevcd_parse_slice.c, there is a possible out of bounds write due to a missing bounds check. This could lead to CVE-2019-22237.8In ihevcd_ref_list of ihevcd_ref_list.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote co CVE-2019-22258.8When pairing with a Bluetooth device, it may be possible to pair a malicious device without any confirmation from the user, and that device CVE-2019-22265.5In device_class_to_int of device_class.cc, there is a possible out of bounds read due to improper casting. This could lead to local informat CVE-2019-22276.5In DeepCopy of btif_av.cc, there is a possible out of bounds read due to improper casting. This could lead to remote information disclosure CVE-2019-22285.5In array_find of array.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disc