CVE-2019-2138

Vulnerability

In libxaac, a library used for audio decoding on Android 10, a missing bounds check allows an out-of-bounds read. This vulnerability affects Android 10 (Android-10) and is addressed in the security patch level 2019-09-01 [1]. The code path is reachable when processing crafted audio input.

Exploitation

Exploitation requires user interaction, such as opening a malicious audio file or media stream. No additional execution privileges are needed; the attacker does not need to be authenticated or have elevated permissions. The user must be tricked into triggering the vulnerable code path in libxaac.

Impact

Successful exploitation leads to information disclosure, as the out-of-bounds read can leak memory contents from the process. The attacker gains no code execution or privilege escalation; the impact is limited to reading potentially sensitive data from the affected device's memory.

Mitigation

The issue is fixed in Android 10 with the security patch level 2019-09-01 [1]. Users should ensure their devices have received this update. No workarounds are documented; applying the patch is the recommended mitigation.