CVE-2019-2062

Vulnerability

In libxaac, the AAC decoder library on Android 10, an out-of-bounds write occurs due to a missing bounds check. This vulnerability affects all Android 10 devices and is reachable when processing a specially crafted audio file. No additional execution privileges are required to trigger the flaw.

Exploitation

An attacker must convince a user to open a malicious media file (user interaction is required). The attacker does not need authentication or special network access beyond delivering the file. The crafted file triggers the out-of-bounds write in libxaac during decoding.

Impact

Successful exploitation leads to remote code execution in the context of the media server or the application processing the file. The attacker can execute arbitrary code, potentially gaining full control of the affected device.

Mitigation

The issue is fixed in Android 10 with the security patch level 2019-09-01 or later [1]. Users should ensure their devices have received this update. No workarounds are available, and the vulnerability is not listed in the KEV catalog.