CVE-2017-13286

HIGH

Android 8.0-8.1 - Local Privilege Escalation via OutputConfiguration Serialization Mismatch

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2017-13286. PoCs published by UmVfX1BvaW50, slient2009.

AI-analyzed exploit summary This PoC exploits a deserialization vulnerability in Android's OutputConfiguration class (CVE-2017-13286) due to inconsistent parcel read/write operations. The exploit constructs a malicious parcel to trigger unintended behavior by leveraging the missing mIsShared read operation.

Description

In writeToParcel and readFromParcel of OutputConfiguration.java, there is a permission bypass due to mismatched serialization. This could lead to a local escalation of privilege where the user can start an activity with system privileges, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 8.0, 8.1. Android ID: A-69683251.

Exploits (2)

nomisec WORKING POC
by UmVfX1BvaW50 · poc
https://github.com/UmVfX1BvaW50/CVE-2017-13286

This PoC exploits a deserialization vulnerability in Android's OutputConfiguration class (CVE-2017-13286) due to inconsistent parcel read/write operations. The exploit constructs a malicious parcel to trigger unintended behavior by leveraging the missing mIsShared read operation.

Classification
Working Poc 90%
Attack Type
Deserialization
Complexity
Moderate
Reliability
Theoretical
Target: Android (AOSP frameworks/base/core/java/android/hardware/camera2/params/OutputConfiguration.java)
No auth needed
Prerequisites: Android device with vulnerable AOSP version · Ability to deliver malicious parcel data
devstral-2 · analyzed Feb 16, 2026 Full analysis →
github WORKING POC
by slient2009 · javapoc
https://github.com/slient2009/CVE-PoCs/tree/main/CVE-2017-13286

This repository contains a functional PoC for CVE-2017-13286, which exploits a deserialization vulnerability in Android's AccountManager service. The exploit manipulates Parcel data to bypass checks and achieve privilege escalation by crafting malicious Bundle payloads.

Classification
Working Poc 90%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Android (specific versions affected by CVE-2017-13286)
No auth needed
Prerequisites: Android device with vulnerable AccountManager service · ability to install and run the PoC app
devstral-2 · analyzed Feb 27, 2026 Full analysis →

References (1)

Core 1
Core References
Vendor Advisory x_refsource_confirm
https://source.android.com/security/bulletin/2018-04-01

Scores

CVSS v3 7.8
EPSS 0.0033
EPSS Percentile 24.6%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-502
Status published
Products (2)
google/android 8.0
google/android 8.1
Published Apr 04, 2018
Tracked Since Feb 18, 2026