CVE-2018-11816 Use After Free in Video
A crafted Binder request triggers a heap use-after-free in MediaServer, potentially allowing code execution or privilege escalation on Qualcomm Snapdragon devices.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-11816?
CVE-2018-11816 is a high-severity use after free vulnerability in Qualcomm Apq8017 Firmware, published on 26 Nov 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Crafted Binder Request Causes Heap UAF in MediaServer
Weakness: CWE-416
Which versions are affected by CVE-2018-11816?
It affects 14 products.
Products include Qualcomm 9206 Lte Modem Firmware, Qualcomm Apq8016 Firmware, Qualcomm Apq8017 Firmware, Qualcomm Apq8039 Firmware, Qualcomm Apq8052 Firmware, Qualcomm Apq8056 Firmware and 8 more.
How do I fix CVE-2018-11816?
No fix has been published for CVE-2018-11816 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2018-11816 being exploited?
There is no known exploitation of CVE-2018-11816 in the wild and no public exploit code.
Other vulnerabilities in Qualcomm Apq8017 Firmware
Sources
Also known as GHSA-7gfr-xrcc-jm66.