CVSS 3.0
9.8 criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2017-18127
In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 430, SD 450, SD 625, SD 650/52, SD 820, SD 835, SD 845, while processing a SetParam command packet in the VR service, the extracted name_len and value_len values are not checked and could potentially cause a buffer overflow in subsequent calls to memcpy().
Severity
- EPSS
- 1.3% chance of exploitation in the next 30 days; higher than 70% of CVEs (scores of 2026-10-31)
- CWE
- CWE-119
- Published
- Modified
- Record from
- the NVD, synced
Affected
- qualcomm:msm8909w_firmware
- qualcomm:sd_205_firmware
- qualcomm:sd_210_firmware
- qualcomm:sd_212_firmware
- qualcomm:sd_430_firmware
- qualcomm:sd_450_firmware
- qualcomm:sd_625_firmware
- qualcomm:sd_650_firmware
- qualcomm:sd_652_firmware
- qualcomm:sd_820_firmware
- qualcomm:sd_835_firmware
- qualcomm:sd_845_firmware