CVE-2018-9557

HIGH

Android <7.1.2 - Memory Corruption

Title source: llm

Description

In really_install_package of install.cpp, there is a possible free of arbitrary memory due to uninitialized data. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2. Android ID: A-35385357.

References (2)

Scores

CVSS v3 7.8
EPSS 0.0002
EPSS Percentile 4.6%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Classification

CWE
CWE-763 CWE-908
Status published

Affected Products (3)

google/android
google/android
google/android

Timeline

Published Dec 06, 2018
Tracked Since Feb 18, 2026