CVE-2014-7911: luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Androi...

Security readout for executives and security teams

CVE-2014-7911 is an Android deserialization flaw affecting Android before 5.0.0. A crafted serialized object sent through an intent to a system service could lead to arbitrary code execution. For executives, the main concern is legacy Android devices that still run pre-5.0 software and cannot receive vendor updates. Exposure is limited to Android systems before 5.0.0 based on the CVE text. The source bundle does not identify specific device vendors, models, apps, or third-party products as affected. Prioritize remediation if the organization still operates Android devices before 5.0.0, especially in privileged or sensitive environments. If no such devices remain, residual business urgency is low. Mitigation focus: Upgrade affected devices to Android 5.0.0 or later where supported.; Apply vendor updates that include the referenced Android libcore change.; Check vendor guidance for backported fixes on legacy Android branches..

Prepared

Jun 14, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.