CVE-2018-11263

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-09-06 · updated 2026-06-17
Weakness: CWE-129

Description

In all Android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the Linux kernel, radio_id is received from the FW and is used to access the buffer to copy the radio stats received for each radio from FW. If the radio_id received from the FW is greater than or equal to maximum, an OOB write will occur. On supported Google Pixel and Nexus devices, this has been addressed in security patch level 2018-08-05.

Affected products

Android: all versions

References

https://source.android.com/security/bulletin/pixel/2018-08-01
https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=476ad571ec5b42c42bb1ce9468f18c7e996646ed
https://www.codeaurora.org/security-bulletin/2018/08/06/august-2018-code-aurora-security-bulletin
https://source.android.com/security/bulletin/pixel/2018-08-01
https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=476ad571ec5b42c42bb1ce9468f18c7e996646ed
https://www.codeaurora.org/security-bulletin/2018/08/06/august-2018-code-aurora-security-bulletin

Get alerted when CVE-2018-11263 or the next vulnerability affects your stack