CVE-2018-11293: Google Android

Medium severity, CVSS 5.7. EPSS: 0.4% chance of exploitation in the next 30 days.

In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, in wma_ndp_confirm_event_handler and wma_ndp_indication_event_handler, ndp_cfg len and num_ndp_app_info is from fw. If they are not checked, it may cause buffer over-read once the value is too large.

Affected products

• Google Android: affected versions not specified

Published 2018-09-18. Last modified 2026-06-17.