CVE-2019-2149

Vulnerability

In libxaac, there is a possible out of bounds read due to a missing bounds check. This vulnerability affects Android 10 devices with a security patch level before 2019-09-01 [1]. The bug is reachable when a user opens a specially crafted file that triggers the flawed code path.

Exploitation

An attacker does not need any additional execution privileges. Exploitation requires user interaction, such as convincing a user to open a malicious media file. The user must parse the crafted file using a library that invokes the vulnerable libxaac code, leading to an out-of-bounds read.

Impact

Successful exploitation results in information disclosure; the attacker can read sensitive data from memory without gaining code execution or elevated privileges. The scope is limited to the data accessible to the affected process.

Mitigation

The issue is fixed in Android 10 with the security patch level of 2019-09-01 [1]. Users should ensure their device has received the September 2019 security update or later. No workaround is available for unpatched devices.