CVE-2014-1909: Google Android Debug Bridge

High severity, CVSS 7.5. EPSS: 2.1% chance of exploitation in the next 30 days.

Integer signedness error in system/core/adb/adb_client.c in Android Debug Bridge (ADB) for Android 4.4 in the Android SDK Platform Tools 18.0.1 allows ADB servers to execute arbitrary code via a negative length value, which bypasses a signed comparison and triggers a stack-based buffer overflow.

Affected products

• Google Android Debug Bridge: affected versions not specified
• Google Android SDK Platform Tools: version 18.0.1 only
• Opensuse Opensuse: version 12.3 only; version 13.1 only

Published 2014-05-14. Last modified 2026-06-17.