CVE-2015-9179: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MSM8974, lack of...

Security readout for executives and security teams

This CVE affects Android devices using Qualcomm Snapdragon Mobile MSM8974 before the April 5, 2018 Android security patch level. A missing length check in an OEMCrypto key-derivation function could allow a buffer overflow. The public bundle does not provide severity, attack vector, or exploitation evidence. Exposure is most likely in legacy Android devices with Qualcomm MSM8974 that remain below the 2018-04-05 Android security patch level. Modern supported devices should be checked by patch level and chipset, not by Android version alone. Prioritize this as a legacy-device hygiene issue unless your fleet still contains MSM8974 Android devices. There is no cited active exploitation, but devices below the 2018-04-05 patch level should not remain trusted for sensitive work without a documented exception. Mitigation focus: Apply Android security patch level 2018-04-05 or later where available.; Check OEM firmware advisories for Qualcomm MSM8974 device models.; Remove or replace unsupported devices that cannot receive the fix..

Prepared

Jun 7, 2026, 14:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.