CVE-2016-3917

Severity: high (CVSS 7.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-10-10 · updated 2026-06-17
Weakness: CWE-264

Description

The fingerprint login feature in Android 6.0.1 before 2016-10-01 and 7.0 before 2016-10-01 does not track the user account during the authentication process, which allows physically proximate attackers to authenticate as an arbitrary user by leveraging lockscreen access, aka internal bug 30744668.

Affected products

Android: 6.0.1, 7.0

References

http://source.android.com/security/bulletin/2016-10-01.html
http://www.securityfocus.com/bid/93298
https://android.googlesource.com/platform/frameworks/base/+/f5334952131afa835dd3f08601fb3bced7b781cd
http://source.android.com/security/bulletin/2016-10-01.html
http://www.securityfocus.com/bid/93298
https://android.googlesource.com/platform/frameworks/base/+/f5334952131afa835dd3f08601fb3bced7b781cd

Get alerted when CVE-2016-3917 or the next vulnerability affects your stack