{"api_version":"1","generated_at":"2026-07-23T09:31:43+00:00","cve":"CVE-2018-5886","urls":{"html":"https://cve.report/CVE-2018-5886","api":"https://cve.report/api/cve/CVE-2018-5886.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2018-5886","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-5886"},"summary":{"title":"CVE-2018-5886","description":"A pointer in an ADSPRPC command is not properly validated in all Android releases from CAF using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android), which can lead to kernel memory being accessed.","state":"PUBLIC","assigner":"product-security@qualcomm.com","published_at":"2018-07-06 19:29:00","updated_at":"2018-08-29 13:49:00"},"problem_types":["CWE-125"],"metrics":[],"references":[{"url":"https://www.codeaurora.org/security-bulletin/2018/07/02/july-2018-code-aurora-security-bulletin","name":"https://www.codeaurora.org/security-bulletin/2018/07/02/july-2018-code-aurora-security-bulletin","refsource":"CONFIRM","tags":["Third Party Advisory"],"title":"July 2018 Code Aurora Security Bulletin - Code Aurora","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=97017d59158086689488bdcfcafb59654a6f10da","name":"https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=97017d59158086689488bdcfcafb59654a6f10da","refsource":"CONFIRM","tags":["Patch","Third Party Advisory"],"title":"kernel/msm-3.18 - Unnamed repository; edit this file 'description' to name the repository.","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-5886","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-5886","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2018","cve_id":"5886","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"google","cpe5":"android","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"5886","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"google","cpe5":"android","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"product-security@qualcomm.com","DATE_PUBLIC":"2018-07-02T00:00:00","ID":"CVE-2018-5886","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Android for MSM, Firefox OS for MSM, QRD Android","version":{"version_data":[{"version_value":"All Android releases from CAF using the Linux kernel"}]}}]},"vendor_name":"Qualcomm, Inc."}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"A pointer in an ADSPRPC command is not properly validated in all Android releases from CAF using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android), which can lead to kernel memory being accessed."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Buffer Over-read in DSP"}]}]},"references":{"reference_data":[{"name":"https://www.codeaurora.org/security-bulletin/2018/07/02/july-2018-code-aurora-security-bulletin","refsource":"CONFIRM","url":"https://www.codeaurora.org/security-bulletin/2018/07/02/july-2018-code-aurora-security-bulletin"},{"name":"https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=97017d59158086689488bdcfcafb59654a6f10da","refsource":"CONFIRM","url":"https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=97017d59158086689488bdcfcafb59654a6f10da"}]}},"nvd":{"publishedDate":"2018-07-06 19:29:00","lastModifiedDate":"2018-08-29 13:49:00","problem_types":["CWE-125"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":5},"severity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":true,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2018","CveId":"5886","Ordinal":"121889","Title":"CVE-2018-5886","CVE":"CVE-2018-5886","Year":"2018"},"notes":[{"CveYear":"2018","CveId":"5886","Ordinal":"1","NoteData":"A pointer in an ADSPRPC command is not properly validated in all Android releases from CAF using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android), which can lead to kernel memory being accessed.","Type":"Description","Title":null},{"CveYear":"2018","CveId":"5886","Ordinal":"2","NoteData":"2018-07-06","Type":"Other","Title":"Published"},{"CveYear":"2018","CveId":"5886","Ordinal":"3","NoteData":"2018-07-06","Type":"Other","Title":"Modified"}]}}}