CVE-2019-14220

An issue was discovered in BlueStacks 4.110 and below on macOS and on 4.120 and below on Windows. BlueStacks employs Android running in a virtual machine (VM) to enable Android apps to run on Windows or MacOS. Bug is in a local arbitrary file read through a system service call. The impacted method runs with System admin privilege and if given the file name as parameter returns you the content of file. A malicious app using the affected method can then read the content of any system file which it is not authorized to read

• CWE-269

• https://support.bluestacks.com/hc/en-us/articles/360021469391-Release-NotesRelease Notes, Vendor Advisory
• https://support.bluestacks.com/hc/en-us/articles/360033484132-BlueStacks-fails-to-restrict-access-permissionsPatch, Vendor Advisory
• https://support.bluestacks.com/hc/en-us/articles/360021469391-Release-NotesRelease Notes, Vendor Advisory
• https://support.bluestacks.com/hc/en-us/articles/360033484132-BlueStacks-fails-to-restrict-access-permissionsPatch, Vendor Advisory

Published

Sep 24, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-14212An issue was discovered in Foxit PhantomPDF before 8.3.11. T…
• CVE-2019-14213An issue was discovered in Foxit PhantomPDF before 8.3.11. T…7.5
• CVE-2019-14214An issue was discovered in Foxit PhantomPDF before 8.3.10. T…
• CVE-2019-14215An issue was discovered in Foxit PhantomPDF before 8.3.11. T…
• CVE-2019-14216An issue was discovered in the svg-vector-icon-plugin (aka W…
• CVE-2019-1422An elevation of privilege vulnerability exists in the way th…7.8
• CVE-2019-142211CRM On-Premise Software 8.5.7 allows XSS via a payload that…
• CVE-2019-14222An issue was discovered in Alfresco Community Edition versio…
• CVE-2019-14223An issue was discovered in Alfresco Community Edition versio…6.1
• CVE-2019-14224An issue was discovered in Alfresco Community Edition 5.2 20…
• CVE-2019-14225OX App Suite 7.10.1 and 7.10.2 allows SSRF.5.4
• CVE-2019-14226OX App Suite through 7.10.2 has Insecure Permissions.8.1