In MPEG4Extractor, there is a possible out of bounds write due to an integer overflow.

Published 7 y ago 2019-09-27 · modified 4 mo ago 2026-06-17 · JSON

CVSS

8.8

v3.1 · NVD

CISA KEV

not known exploited

EPSS

0.8%

percentile 58%

Public exploits

none known

In MPEG4Extractor, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution in the media extractor with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-111792351

Exploit prediction (EPSS)

0.83% probability of exploitation in the next 30 days, higher than 58% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.1	8.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`
NVD	2.0	6.8	`AV:N/AC:M/Au:N/C:P/I:P/A:P`

Affected products

n/a Android

Classification

Weakness

CWE-190 Integer Overflow or Wraparound
CWE-787 Out-of-bounds Write

References

source.android.com /security/bulletin/android-10 · x_refsource_MISC, x_transferred

Sources

CVE List: CVE-2019-9262
NVD: CVE-2019-9262

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.