CVE-2017-11089

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-11-16 · updated 2026-06-17
Weakness: CWE-125

Description

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a buffer overread is observed in nl80211_set_station when user space application sends attribute NL80211_ATTR_LOCAL_MESH_POWER_MODE with data of size less than 4 bytes

Affected products

Android: all versions

References

https://source.android.com/security/bulletin/pixel/2017-11-01
https://usn.ubuntu.com/3620-1/
https://usn.ubuntu.com/3620-2/
https://source.android.com/security/bulletin/pixel/2017-11-01
https://usn.ubuntu.com/3620-1/
https://usn.ubuntu.com/3620-2/

Get alerted when CVE-2017-11089 or the next vulnerability affects your stack