CVE-2011-3874: Google Android

High severity, CVSS 9.3. EPSS: 11.4% chance of exploitation in the next 30 days.

Stack-based buffer overflow in libsysutils in Android 2.2.x through 2.2.2 and 2.3.x through 2.3.6 allows user-assisted remote attackers to execute arbitrary code via an application that calls the FrameworkListener::dispatchCommand method with the wrong number of arguments, as demonstrated by zergRush to trigger a use-after-free error.

Affected products

• Google Android: version 2.2 only; version 2.2.1 only; version 2.2.2 only; version 2.3 only; version 2.3.1 only; version 2.3.2 only; …

Published 2012-01-27. Last modified 2026-06-16.