CVE-2017-13253: In CryptoPlugin::decrypt of CryptoPlugin.cpp, there is a possible out of bounds write due to a missing boun...

Security readout for executives and security teams

CVE-2017-13253 affects Android 8.0 and 8.1. A missing bounds check in CryptoPlugin::decrypt can allow memory corruption. If exploited locally, it could let an attacker gain higher privileges. The CVE states user interaction is required, so risk depends on vulnerable devices still in use and unpatched. Exposure is limited to Android 8.0 and 8.1 systems that did not receive the relevant March 2018 Android security update or equivalent vendor patch. Modern supported Android versions are not listed as affected in the provided sources. Treat this as a legacy mobile endpoint risk. It is not KEV-listed, but local privilege escalation plus public exploit-related material warrants prioritizing unpatched Android 8.x devices, especially where they access corporate data. Mitigation focus: Apply the Android March 2018 security bulletin updates or vendor equivalent.; Prioritize legacy Android 8.0 and 8.1 devices for retirement or patch verification.; Check OEM carrier security patch levels for affected device models..

Prepared

Jun 7, 2026, 14:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.