In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing VENDOR spe…

published 2018-03-15 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-6360

cvss: 7.5; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.0%; EPSS 1.0% chance of exploitation in 30 days, percentile 62%
public exploits: 0; none known

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing VENDOR specific action frame in the function lim_process_action_vendor_specific(), a comparison is performed with the incoming action frame body without validating if the action frame body received is of valid length, potentially leading to an out-of-bounds access.

Patch / fix

links 1

source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/co… commit

Exploit prediction

0.98% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.0	7.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	7.8	AV:N/AC:L/Au:N/C:C/I:N/A:N

Classification

Weakness

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

source.codeaurora.org /quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=cd10091f03f6255a47d7146eea5738f1f4ceea35
patch, third-party-advisory
source.android.com /security/bulletin/2018-03-01
vendor-advisory
securityfocus.com /bid/103254
vdb-entry, third-party-advisory

Sources

CVE List CVE-2017-14882
NVD CVE-2017-14882

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary