CVE-2018-9594

In llcp_link_proc_agf_pdu of llcp_link.cc in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure over NFC with no additional execution privileges needed. User interaction is not needed for exploitation. Android ID: A-116791157.

• CWE-125
• CWE-190

• http://www.securityfocus.com/bid/106495Third Party Advisory, VDB Entry
• https://source.android.com/security/bulletin/2019-01-01.htmlVendor Advisory
• http://www.securityfocus.com/bid/106495Third Party Advisory, VDB Entry
• https://source.android.com/security/bulletin/2019-01-01.htmlVendor Advisory

Published

Feb 11, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-9588In avdt_scb_hdl_report of avdt_scb_act.cc in Android-7.0, An…
• CVE-2018-9589In ieee802_11_rx_wnmsleep_req of wnm_ap.c in Android-7.0, An…
• CVE-2018-9590In add_attr of sdp_discovery.c in Android-7.0, Android-7.1.1…
• CVE-2018-9591In bta_hh_ctrl_dat_act of bta_hh_act.cc in Android-7.0, Andr…
• CVE-2018-9592In mca_ccb_hdl_rsp of mca_cact.cc in Android-7.0, Android-7.…
• CVE-2018-9593In llcp_dlc_proc_i_pdu of llcp_dlc.cc in Android-7.0, Androi…
• CVE-2018-9838The caml_ba_deserialize function in byterun/bigarray.c in th…
• CVE-2018-9839An issue was discovered in MantisBT through 1.3.14, and 2.0.…
• CVE-2018-9840The Open Whisper Signal app before 2.23.2 for iOS allows phy…
• CVE-2018-9841The export function in libavfilter/vf_signature.c in FFmpeg …
• CVE-2018-9842CyberArk Password Vault before 9.7 allows remote attackers t…
• CVE-2018-9843The REST API in CyberArk Password Vault Web Access before 9.…