CVE-2019-6740

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-06-03 · updated 2026-06-17
Weakness: CWE-122

Description

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S9 prior to January 2019 Security Update (SMR-JAN-2019 - SVE-2018-13467). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the ASN.1 parser. When parsing ASN.1 strings, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7472.

Affected products

Samsung Galaxy S9: before 2019-01 — fixed in 2019-01

How to fix

Upgrade to a fixed version: Samsung Galaxy S9 2019-01. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-6740 or the next vulnerability affects your stack