CVE-2018-9361: In process_l2cap_cmd of l2c_main.cc, there is a possible out of bounds read due to a missing bounds check.

Security readout for executives and security teams

CVE-2018-9361 is an Android flaw that could let a remote attacker read information from affected devices because a bounds check was missing in L2CAP command processing. The public sources do not report code execution, privilege gain, or active exploitation. Exposure is most relevant to unmanaged, unsupported, or unpatched Android 6.0, 6.0.1, 7.x, 8.0, and 8.1 devices. Fully patched devices with vendor updates covering the June 2018 Android bulletin should be lower concern. Treat this as a legacy Android hygiene issue with privacy risk. It is not supported by the sources as actively exploited, but affected unpatched devices are old enough to warrant removal, patch verification, or compensating controls. Mitigation focus: Apply Android vendor updates covering the June 2018 security bulletin.; Prioritize unsupported Android 6.0 through 8.1 devices for replacement or isolation.; Check OEM advisories for device-specific patch availability and patch level mapping..

Prepared

Jun 6, 2026, 22:26 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.