CVE-2017-13266: In avrc_pars_vendor_cmd of avrc_pars_tg.cc, there is a possible stack corruption due to a missing bounds ch...

Security readout for executives and security teams

This is an old Android memory-safety issue that could let an attacker run code remotely on affected devices. The main business risk is unmanaged legacy Android endpoints that never received the March 2018 Android security update or vendor equivalent. No source in the bundle says it is currently exploited. Exposure is limited to Android devices running the listed affected versions, especially legacy or unmanaged devices unable to receive 2018-era security updates. The source bundle does not identify non-Android products or downstream OEM patch status. Prioritize this for legacy Android risk management. It is not a current KEV-listed emergency, but remote code execution without user interaction makes unsupported affected devices unacceptable in managed environments. Mitigation focus: Apply Android or OEM updates that include the March 2018 security bulletin fix for CVE-2017-13266.; Retire or isolate Android 5.1.1 through 8.1 devices that cannot receive vendor security updates.; Use mobile device management to enforce minimum security patch levels on corporate Android endpoints..

Prepared

Jun 7, 2026, 14:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.