CVE-2026-124038 Uncontrolled XML entity expansion in the Flock Installer app for Android
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-124038?
CVE-2026-124038 is a low-severity vulnerability in Flock Installer app, published on 10 Nov 2026.
Official description
An uncontrolled XML entity expansion vulnerability in the Flock Installer app for Android before version 2.35.0 allows an attacker who has a valid technician account and controls or impersonates the camera being set up to crash the app, on devices running Android 10, 11 or 12, by returning a camera configuration response that contains nested XML entity declarations. The vulnerability does not allow the attacker to read or change data on the device, and no customer license plate, video or location data is exposed. Android 13 and later reject the response. The issue is fixed in version 2.35.0; update to 2.35.0 or later.
Weakness: CWE-776
Which versions are affected by CVE-2026-124038?
How do I fix CVE-2026-124038?
No fix has been published for CVE-2026-124038 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-124038 being exploited?
There is no known exploitation of CVE-2026-124038 in the wild and no public exploit code.
Sources
Also known as GHSA-qmhx-hvfj-57q8.