CVE-2017-13177
Status: ModifiedCritical (9.8)—
Severity9.8Critical · CVSS 3.0
Exploitation probability2.42 %higher than 84% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found
In several functions of libhevc, NEON registers are not preserved. This could lead to remote code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-68320413.
CVSS
- Base score
- 9.8
- Version
- 3.0
- Vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days
- 2.42 %
- Percentile among all scored CVEs
- 84
- Score date
- 10/22/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
CWEs
- CWE-119
References
Raw JSON (NVD)
Show
{
"id": "CVE-2017-13177",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 10,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"authentication": "NONE",
"integrityImpact": "COMPLETE",
"accessComplexity": "LOW",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "security@android.com",
"affectedData": [
{
"vendor": "Google Inc.",
"product": "Android",
"versions": [
{
"status": "affected",
"version": "5.1.1"
},
{
"status": "affected",
"version": "6.0"
},
{
"status": "affected",
"version": "6.0.1"
},
{
"status": "affected",
"version": "7.0"
},
{
"status": "affected",
"version": "7.1.1"
},
{
"status": "affected",
"version": "7.1.2"
},
{
"status": "affected",
"version": "8.0"
},
{
"status": "affected",
"version": "8.1"
}
]
}
]
}
],
"published": "2018-01-12T23:29:00.343",
"references": [
{
"url": "http://www.securityfocus.com/bid/102414",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "security@android.com"
},
{
"url": "http://www.securitytracker.com/id/1040106",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "security@android.com"
},
{
"url": "https://source.android.com/security/bulletin/2018-01-01",
"tags": [
"Vendor Advisory"
],
"source": "security@android.com"
},
{
"url": "http://www.securityfocus.com/bid/102414",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securitytracker.com/id/1040106",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://source.android.com/security/bulletin/2018-01-01",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-119"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In several functions of libhevc, NEON registers are not preserved. This could lead to remote code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-68320413."
},
{
"lang": "es",
"value": "En varias funciones de libhevc, no se mantienen los registros NEON. Esto podría llevar a una ejecución remota de código como proceso privilegiado sin necesitar privilegios de ejecución adicionales. No se necesita interacción del usuario para explotarlo. Producto: Android. Versiones: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-68320413."
}
],
"lastModified": "2026-06-17T01:04:40.510",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B1D94CDD-DE7B-444E-A3AE-AE9C9A779374"
},
{
"criteria": "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E70C6D8D-C9C3-4D92-8DFC-71F59E068295"
},
{
"criteria": "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "691FA41B-C2CE-413F-ABB1-0B22CB322807"
},
{
"criteria": "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "09E6085C-A61E-4A89-BF80-EDD9A7DF1E47"
},
{
"criteria": "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D835D592-2423-44C6-804A-3AD010112E7C"
},
{
"criteria": "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "568E2561-A068-46A2-B331-BBA91FC96F0C"
},
{
"criteria": "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B578E383-0D77-4AC7-9C81-3F0B8C18E033"
},
{
"criteria": "cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B06BE74B-83F4-41A3-8AD3-2E6248F7B0B2"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "security@android.com"
}