CVE-2018-10751 json
A malformed OMACP WAP push message can cause memory corruption on a Samsung S7 Edge device when processing the String Extension portion of…
published 2018-05-29 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-2821
- cvss
- 5.3
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 8.6%
- EPSS 8.6% chance of exploitation in 30 days, percentile 95%
- public exploits
- 1
- Exploit-DB
Summary
A malformed OMACP WAP push message can cause memory corruption on a Samsung S7 Edge device when processing the String Extension portion of the WbXml payload. This is due to an integer overflow in memory allocation for this string. The Samsung ID is SVE-2018-11463.
Timeline
- First public exploit (EDB-44724)
- Published
Exploit prediction
8.57% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- EDB-44724 Samsung Galaxy S7 Edge - Overflow in OMACP WbXml String Extension Processing dos, 2018-05-23
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 5.3 | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 5.4 | AV:N/AC:H/Au:N/C:N/I:N/A:C |
Classification
- Weakness
-
- CWE-190 Integer Overflow or Wraparound
References
-
exploit-db.com
/exploits/44724/
exploit, third-party-advisory, vdb-entry
-
packetstormsecurity.com
/files/147841/Samsung-Galaxy-S7-Edge-OMACP-WbXml-String-Extension-Processing-Overflow.html
third-party-advisory, vdb-entry
-
security.samsungmobile.com
/securityUpdate.smsb
third-party-advisory
Sources
- CVE List CVE-2018-10751
- NVD CVE-2018-10751
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.