Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Android may let apps gain higher system rights

CVE-2019-2120 · published 7 years ago
Summary

Certain Android versions (7.0 through 9) contain a flaw in the OatFileAssistant component that can corrupt files due to an insecure default setting. This can allow a malicious app on the device to elevate its privileges without needing user interaction. Apply the latest security updates from Google to fix the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
google android 7.0
7.1.1
7.1.2
8.0
8.1
9.0
cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*
Original advisory text
In OatFileAssistant::GenerateOatFile of oat_file_assistant.cc, there is a possible file corruption issue due to an insecure default value. This could lead to local escalation of privilege with no a...
In OatFileAssistant::GenerateOatFile of oat_file_assistant.cc, there is a possible file corruption issue due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-130821293.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-1188Initialization of a Resource with an Insecure Default
Timeline
Published20 Aug 2019
Updated26 Oct 2026
First seen29 Sep 2026
Sources
CVE-2019-2120 · NVD
Track software like this
Free during beta