Security readout for executives and security teams
Plain-English summary
CVE-2017-13277 is an Android memory corruption issue that could allow remote code execution after user interaction. The source bundle lists Android 6.0 through 8.1 as affected. No active exploitation is cited, but the impact is serious for unmanaged or legacy Android devices.
Executive priority
Prioritize this for legacy Android environments. The business concern is remote code execution on older devices, especially where those devices access corporate data or networks. Absence from KEV reduces urgency compared with exploited vulnerabilities, but unsupported devices should not remain unmanaged.
Technical view
The issue is a possible out-of-bounds write in ihevcd_fmt_conv within ihevcd_fmt_conv.c, caused by a missing bounds check. Google’s CVE text says exploitation could lead to remote code execution without additional privileges, with user interaction required. No CVSS score or CWE is provided in the bundle.
Likely exposure
Exposure is limited to unpatched Android devices running versions 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, or 8.1. Organizations with legacy Android fleets, unmanaged BYOD, kiosks, scanners, or embedded Android devices should verify patch status.
Exploitation context
The bundle does not cite known active exploitation, and KEV status is false. Exploitation requires user interaction, but the source does not specify the exact delivery path or exploit maturity. Treat the risk as credible because the documented consequence is remote code execution.
Researcher notes
Available evidence is sparse: no CVSS, CWE, patch diff details, or exploit status are included in the bundle. Analysis should stay anchored to Google’s bulletin and CVE record. Focus validation on affected Android versions, OEM patch lineage, and Android ID A-72165027.
Mitigation direction
- Inventory Android devices running versions 6.0 through 8.1.
- Apply vendor or OEM updates covering the April 2018 Android security bulletin.
- Track Android ID A-72165027 in vulnerability management records.
- Retire or isolate devices that cannot receive relevant security updates.
- Restrict risky content handling on legacy devices where patching is unavailable.
Validation and detection
- Confirm Android OS version and security patch level on managed devices.
- Check OEM firmware notes against Android ID A-72165027.
- Verify the April 2018 Android security bulletin fixes are present.
- Review MDM inventory for unsupported Android 6.0 through 8.1 devices.
- Document any compensating controls for devices that cannot be patched.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Execution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2017-13277 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://source.android.com/security/bulletin/2018-04-01CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.