CVE-2019-5225

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-11-29 · updated 2026-06-17
Weakness: CWE-120

Description

P30, Mate 20, P30 Pro smartphones with software of versions earlier than ELLE-AL00B 9.1.0.193(C00E190R1P21), versions earlier than Hima-AL00B 9.1.0.135(C00E200R2P1), versions earlier than VOGUE-AL00A 9.1.0.193(C00E190R1P12) have a buffer overflow vulnerability on several , the system does not properly validate certain length parameter which an application transports to kernel. An attacker tricks the user to install a malicious application, successful exploit could cause malicious code execution.

Affected products

HUAWEI Mate 20: before hima-al00b_9.1.0.135\(c00e200r2p1\) — fixed in hima-al00b_9.1.0.135\(c00e200r2p1\)
HUAWEI P30: before elle-al00b_9.1.0.193\(c00e190r1p21\) — fixed in elle-al00b_9.1.0.193\(c00e190r1p21\)
HUAWEI P30 Pro: before vogue-al00a_9.1.0.193\(c00e190r1p12\) — fixed in vogue-al00a_9.1.0.193\(c00e190r1p12\)

How to fix

Upgrade to a fixed version: HUAWEI Mate 20 hima-al00b_9.1.0.135\(c00e200r2p1\); HUAWEI P30 elle-al00b_9.1.0.193\(c00e190r1p21\); HUAWEI P30 Pro vogue-al00a_9.1.0.193\(c00e190r1p12\). Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-5225 or the next vulnerability affects your stack