CVE-2019-9423

The vulnerability resides in OpenCV functions that invoke libpng for image processing. A missing bounds check leads to an out-of-bounds write when handling specially crafted PNG data, potentially corrupting adjacent memory. The issue is identified in Android's OpenCV usage and tracked as Android ID A-110986616 [1][3].

Exploitation requires no user interaction and no additional execution privileges beyond normal app permissions. An attacker already running a malicious application on an affected Android device can trigger the flaw by supplying a malformed PNG image to an OpenCV call. The attack surface is local, meaning the adversary must be on the device itself [1][3].

Successful exploitation could allow the attacker to escalate their privileges within the Android system, potentially gaining root or system-level access. This would enable them to bypass security restrictions, access sensitive data, or further compromise the device [1][3].

The vulnerability is addressed in Android 10, with devices that have a security patch level of 2019-09-01 or later being protected. The fix is included in the Android Open Source Project (AOSP) release, and partners were notified prior to disclosure [1]. No active exploitation was reported at publication [1].