CVE-2017-13281

CRITICAL

Google Android - Memory Corruption

Title source: rule

Description

In avrc_pars_browsing_cmd of avrc_pars_tg.cc, there is a possible stack buffer overflow due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 8.0, 8.1. Android ID: A-71603262.

Exploits (1)

github WORKING POC 8 stars

by codecat007 · cpoc

https://github.com/codecat007/cvehub/tree/main/android/Bluedroid/avrcp_CVE-2017-13281.c

View Code ZIP pw:eip

References (1)

[Vendor Advisory] https://source.android.com/security/bulletin/2018-04-01

Scores

CVSS v3 9.8

EPSS 0.0254

EPSS Percentile 85.2%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-119

Status published

Affected Products (2)

google/android

Timeline

Published Apr 04, 2018

Tracked Since Feb 18, 2026