CVE-2014-9960: In all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in the Play...

Security readout for executives and security teams

CVE-2014-9960 is a reported buffer overflow in the PlayReady API affecting Android releases from CAF that use the Linux kernel. The public metadata is sparse, so business impact and urgency depend on whether your Android device fleet or product firmware used the affected Qualcomm/CAF code and received the June 2017-era security updates. Exposure is most likely in older Android devices, firmware, or downstream builds based on Qualcomm CAF Linux kernel releases that included the affected PlayReady API. The affected-product statement is broad and not device-specific. Medium operational priority if your environment includes legacy Qualcomm-based Android devices; otherwise monitor. The uncertainty is high enough to justify inventory validation, but the sources do not support an emergency active-exploitation response. Mitigation focus: Check Android, Qualcomm, and OEM guidance tied to the June 2017 bulletin.; Apply available vendor security updates for affected Android device builds.; Prioritize unsupported or unpatched Qualcomm-based Android devices for replacement..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.