Vulnerability · Published May 6, 2020 · Assigned by Google

CVE-2020-8899Memory corruption in Quram library when decoding qmg can lead to RCE

Critical 10.0

In plain English

A critical-severity heap buffer overflow in Android OS from Samsung. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.1% (higher than 93% of all known vulnerabilities).

Severity (CVSS 4.0)10.0Critical

Exploit odds (30 days)6.1%top 6.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

There is a buffer overwrite vulnerability in the Quram qmg library of Samsung's Android OS versions O(8.x), P(9.0) and Q(10.0). An unauthenticated, unauthorized attacker sending a specially crafted MMS to a vulnerable phone can trigger a heap-based buffer overflow in the Quram image codec leading to an arbitrary remote code execution (RCE) without any user interaction. The Samsung ID is SVE-2020-16747.

Affected products (as reported)

Vendor	Product	Versions
Samsung	Android OS	9.010.08.0

Weakness: CWE-122 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

References

https://security.samsungmobile.com/securityUpdate.smsb x_refsource_CONFIRM
https://bugs.chromium.org/p/project-zero/issues/detail?id=2002 x_refsource_CONFIRM
http://packetstormsecurity.com/files/157620/Samsung-Android-Remote-Code-Execution.html x_refsource_MISC
VU#366027 third-party-advisory, x_refsource_CERT-VN