CVE-2019-2136
In Status::readFromParcel of Status.cpp, there is a possible out of bounds read due to improper...
CVE-2019-2136 is a medium vulnerability (CVSS 5.5) in Google Android, published August 20, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 7th percentile. No source names a fixed version.
In Status::readFromParcel of Status.cpp, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-132650049.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
In Status::readFromParcel of Status.cpp, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-132650049.
- Record
CVE-2019-2136- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.9 Medium
AV:L/AC:L/Au:N/C:C/I:N/A:N - Weakness
- CWE-20, CWE-125
- Updated
- 2026-11-02
CVE List No score
In Status::readFromParcel of Status.cpp, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-132650049.
- Record
CVE-2019-2136- Updated
- 2026-11-02
EUVDEUVD-2019-11778 No score
In Status::readFromParcel of Status.cpp, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-132650049.
- Record
EUVD-2019-11778- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4mfw-7w9q-m25x No score
In Status::readFromParcel of Status.cpp, there is a possible out of bounds read due to improper...
In Status::readFromParcel of Status.cpp, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-132650049.
- Record
GHSA-4mfw-7w9q-m25x- Weakness
- CWE-125
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-2136
In Status::readFromParcel of Status.cpp, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-132650049.
- Record
UBUNTU-CVE-2019-2136- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
android-platform-frameworks-nativeUbuntu:16.04:LTS |
All versions, plus listed versions 21-31:6.0.0+r26-21:6.0.1+r16-1 |
None known |
android-platform-frameworks-nativeUbuntu:18.04:LTS |
All versions, plus listed versions 1:7.0.0+r33-11:8.1.0+r23-2~18.04 |
None known |
android-platform-frameworks-nativeUbuntu:20.04:LTS |
All versions, plus listed versions 1:8.1.0+r23-21:8.1.0+r23-2build1 |
None known |
android-platform-frameworks-nativeUbuntu:22.04:LTS |
All versions, plus listed versions 1:10.0.0+r36-1 |
None known |
android-platform-frameworks-nativeUbuntu:24.04:LTS |
All versions, plus listed versions 1:10.0.0+r36-1 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |