cbcvebase.
CVE-2017-13177
published 2018-01-12

CVE-2017-13177: In several functions of libhevc, NEON registers are not preserved. This could lead to remote code execution as a privileged process with no additional…

PriorityP357critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
2.42%
82.4th percentile
In several functions of libhevc, NEON registers are not preserved. This could lead to remote code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-68320413.

Affected

17 ranges
VendorProductVersion rangeFixed in
googleandroid——
googleandroid——
googleandroid——
googleandroid——
googleandroid——
googleandroid——
googleandroid——
googleandroid——
googleandroid——
google_incandroid——
google_incandroid——
google_incandroid——
google_incandroid——
google_incandroid——
google_incandroid——
google_incandroid——
google_incandroid——

Detection & IOCsextracted from sources · hover to see the quote

  • →Vulnerability resides in libhevc (Android HEVC decoder library); monitor for crashes or anomalous behavior in processes loading libhevc.so, particularly media server or privileged media processing processes ↗
  • →No user interaction is required for exploitation; attack surface includes any media parsing pipeline that processes HEVC/H.265 content remotely (e.g., MMS, browser-based media) ↗
  • →Affected Android versions are 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1; prioritize detection/patching on unpatched devices running these versions ↗
  • ·This is rated CRITICAL with RCE impact but requires no additional privileges or user interaction, meaning exploitation can be triggered silently via malicious HEVC media delivered to a vulnerable device ↗
  • ·The root cause is improper preservation of ARM NEON registers in multiple libhevc functions, which can corrupt execution state and redirect control flow; detection via static analysis of libhevc.so version may be more reliable than behavioral detection alone ↗

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.