CVE-2020-8899 | There is a buffer overwrite vulnerability in the Quram qmg l… | CVSS 10.0 CRITICAL

Description

There is a buffer overwrite vulnerability in the Quram qmg library of Samsung's Android OS versions O(8.x), P(9.0) and Q(10.0). An unauthenticated, unauthorized attacker sending a specially crafted MMS to a vulnerable phone can trigger a heap-based buffer overflow in the Quram image codec leading to an arbitrary remote code execution (RCE) without any user interaction. The Samsung ID is SVE-2020-16747.

Metadata

CVE ID: CVE-2020-8899
State: PUBLISHED
Assigner: Google
Reserved: 2020-02-12 00:00 UTC
Published: 2020-05-06 16:25 UTC
Last updated: 2024-09-17 03:38 UTC
Primary CWE: CWE-122
CWE-122 Heap-based Buffer Overflow
Vendor / Product: Samsung / Android OS
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

Affected products (1)

Vendor	Product	Platform	Versions
Samsung	Android OS	—	9.0, 10.0, 8.0

Weakness (CWE)

CWE	Source	Description
CWE-122	cna	CWE-122 Heap-based Buffer Overflow

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

References (4)