Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Google Android WideVine may allow remote code execution

CVE-2021-0592 · published 5 years ago
Summary

The WideVine media component in Android can write outside its memory bounds when it receives specially crafted input. This flaw could let an attacker run code on the device without extra privileges, though the user must open the malicious content first. Install the latest Android updates and keep devices patched to protect against this risk.

What to do
  • Update google :unknown: to version SoCVersion:2021-07-05.
Affected software
Ecosystem VendorProductAffected versions
Android google :unknown: >= SoCVersion:0, < SoCVersion:2021-07-05
Fix: upgrade to SoCVersion:2021-07-05
– google android All versions
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
Original advisory text
In various functions in WideVine, there are possible out of bounds writes due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. ...
In various functions in WideVine, there are possible out of bounds writes due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.
References
Severity
8.8 High
Exploitation
1% chance of attack within 30 days
Type
CWE-787Out-of-bounds Write
Timeline
Published1 Jul 2021
Updated4 Nov 2026
First seen10 Sep 2026
Sources
ASB-A-188061006 · OSV
CVE-2021-0592 · NVD
Track software like this
Free during beta