CVE-2008-0986

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2008-03-06 · updated 2026-06-16
Weakness: CWE-189

Description

Integer overflow in the BMP::readFromStream method in the libsgl.so library in Google Android SDK m3-rc37a and earlier, and m5-rc14, allows remote attackers to execute arbitrary code via a crafted BMP file with a header containing a negative offset field.

Affected products

Google Android Sdk: through m3-rc37a; m5-rc14

References

http://android-developers.blogspot.com/2008/03/android-sdk-update-m5-rc15-released.html
http://securityreason.com/securityalert/3727
http://www.coresecurity.com/?action=item&id=2148
http://www.securityfocus.com/archive/1/489135/100/0/threaded
http://www.securityfocus.com/bid/28006
https://exchange.xforce.ibmcloud.com/vulnerabilities/40999
http://android-developers.blogspot.com/2008/03/android-sdk-update-m5-rc15-released.html
http://securityreason.com/securityalert/3727
http://www.coresecurity.com/?action=item&id=2148
http://www.securityfocus.com/archive/1/489135/100/0/threaded
http://www.securityfocus.com/bid/28006
https://exchange.xforce.ibmcloud.com/vulnerabilities/40999

Get alerted when CVE-2008-0986 or the next vulnerability affects your stack