CVE-2008-0986: Google Android SDK

High severity, CVSS 7.5. EPSS: 4.9% chance of exploitation in the next 30 days.

Integer overflow in the BMP::readFromStream method in the libsgl.so library in Google Android SDK m3-rc37a and earlier, and m5-rc14, allows remote attackers to execute arbitrary code via a crafted BMP file with a header containing a negative offset field.

Affected products

• Google Android SDK: up to and including m3-rc37a; version m5-rc14 only

Published 2008-03-06. Last modified 2026-06-16.