In binder_transaction of binder.c, there is a possible out of bounds write due to a missing bounds check.

published 2019-11-13 6y ago modified 2026-06-17 4mo ago also EUVD-2019-11856

cvss: 7.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 26%
public exploits: 0; none known

In binder_transaction of binder.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-136210786References: Upstream kernel

Patch / fix

distros 2

debian ubuntu

linux Debian 14, Debian 13, Debian 12 5.2.6-1

debian advisories DEBIAN-CVE-2019-2214

linux-gcp Ubuntu 18.04 LTS 5.0.0-1028.29~18.04.1
linux-hwe Ubuntu 18.04 LTS 5.3.0-26.28~18.04.1
linux-azure Ubuntu 18.04 LTS 5.0.0-1028.30~18.04.1
linux-aws-5.0 Ubuntu 18.04 LTS 5.0.0-1023.26~18.04.1
linux-gke-5.0 Ubuntu 18.04 LTS 5.0.0-1027.28~18.04.1
linux-oem-osp1 Ubuntu 18.04 LTS 5.0.0-1033.38
linux-oracle-5.0 Ubuntu 18.04 LTS 5.0.0-1009.14~18.04.1

ubuntu advisories UBUNTU-CVE-2019-2214

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2019-2214 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploit prediction

0.33% chance of exploitation in the next 30 days, higher than 26% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.2	AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected products

n/a Android

Classification

Weakness

CWE-787 Out-of-bounds Write

References

usn.ubuntu.com /4226-1/
vendor-advisory, third-party-advisory
source.android.com /security/bulletin/2019-11-01
vendor-advisory
packetstormsecurity.com /files/156185/Kernel-Live-Patch-Security-Notice-LSN-0062-1.html
third-party-advisory, vdb-entry

Sources

CVE List CVE-2019-2214
NVD CVE-2019-2214

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.