LiveActive security incident?Get immediate response
CVE Record

CVE-2018-9353: In ihevcd_parse_slice_data of ihevcd_parse_slice.c there is a possible heap buffer out of bound read due to...

In ihevcd_parse_slice_data of ihevcd_parse_slice.c there is a possible heap buffer out of bound read due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.

MediumCVSS 6.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2018-9353 is an Android media parsing flaw that can make affected devices crash or become unavailable after a user interacts with attacker-supplied content. The public record describes denial of service, not data theft or code execution. Exposure centers on Android 7.x and 8.x devices lacking the relevant June 2018 Android/Pixel security fixes.

Executive priority

Treat this as a moderate mobile availability risk, mainly for legacy Android fleets. Prioritize confirmation of patch coverage and unsupported-device retirement, but do not treat it as an active breach indicator based on the provided sources.

Technical view

The issue is a CWE-125 heap out-of-bounds read in ihevcd_parse_slice_data in ihevcd_parse_slice.c, caused by a missing bounds check. CVSS 3.1 is 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. The documented impact is remote denial of service requiring user interaction.

Likely exposure

Organizations are most exposed where Android 7, 7.1.1, 7.1.2, 8, or 8.1 devices remain in use without vendor security updates. Risk is lower for managed fleets that enforce current patch levels or retire unsupported devices.

Exploitation context

The sources do not report active exploitation, and the CVE is not marked KEV. Exploitation requires user interaction and no privileges, with the stated outcome limited to availability impact. Public evidence does not support claims of code execution or data compromise.

Researcher notes

Evidence identifies an out-of-bounds read in Android HEVC parsing with availability impact only. The record provides affected Android versions and CVSS details, but limited remediation specifics beyond the Android/Pixel bulletin reference. Avoid expanding scope to other products without vendor evidence.

Mitigation direction

  • Apply the relevant Android or Pixel security update from vendor guidance.
  • Retire or isolate Android 7.x and 8.x devices that cannot be patched.
  • Enforce mobile device management patch compliance for affected Android versions.
  • Review OEM support status for non-Pixel Android devices.

Validation and detection

  • Inventory Android devices running versions 7, 7.1.1, 7.1.2, 8, or 8.1.
  • Confirm device security patch levels against the June 2018 bulletin guidance.
  • Identify devices no longer receiving OEM security updates.
  • Check vulnerability management records for CVE-2018-9353 coverage.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-125: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2018-9353 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.5CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H2.83.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

6.5Medium
CVSS 3.1 vector shape for CVE-2018-9353Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
GoogleAndroid7, 7.1.1, 7.1.2, 8, 8.1unaffected
Weakness

CWE details

CWE-125

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-125 · source CWE mapping

Out-of-bounds Read

Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs