CVE-2018-9499 json
In readVector of iCrypto.cpp, there is a possible invalid read due to uninitialized data.
published 2018-10-02 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-21093
- cvss
- 5.5
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 23%
- public exploits
- 0
- none known
Summary
In readVector of iCrypto.cpp, there is a possible invalid read due to uninitialized data. This could lead to local information disclosure from the DRM server with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9.0 Android ID: A-79218474
Patch / fix
Exploit prediction
0.30% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- android.googlesource.com https://android.googlesource.com/platform/frameworks/av/+/bf7a67c33c0f044abeef3b9746f434b7f3295bb1 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 5.5 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 4.9 | AV:L/AC:L/Au:N/C:C/I:N/A:N |
Affected products
- Google Inc. Android
Classification
- Weakness
-
- CWE-908 Use of Uninitialized Resource
References
-
android.googlesource.com
/platform/frameworks/av/+/bf7a67c33c0f044abeef3b9746f434b7f3295bb1
exploit, patch, vendor-advisory
-
source.android.com
/security/bulletin/2018-10-01
patch, vendor-advisory
- source.android.com /security/bulletin/2018-10-01%2C
-
securityfocus.com
/bid/105481
vdb-entry, third-party-advisory
Sources
- CVE List CVE-2018-9499
- NVD CVE-2018-9499
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.