High severity · published Oct 11, 2019
CVE-2019-2215
Android Kernel Use-After-Free Vulnerability
In wildKEV
7.8
CVSS
72.1%
EPSS
Yes
On KEV
Description
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.Product: AndroidAndroid ID: A-141720095
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)72.1% · higher than 99% of CVEs
Exploited in the wildYes
CISA KEVListed Nov 3, 2021
Federal remediation dueMay 3, 2022
Ransomware campaign useNot known
Affected products
Which versions
AN
Android · Google
Kernel · source: vendor, NVD
AF
A220 Firmware · Netapp
All versions, or not specified · source: NVD
AF
A320 Firmware · Netapp
All versions, or not specified · source: NVD
AF
A800 Firmware · Netapp
All versions, or not specified · source: NVD
AB
Aff Baseboard Management Controller Firmware · Netapp
All versions, or not specified · source: NVD
AF
Alp-al00b Firmware · Huawei
before 10.0.0.162\(c00e156r2p4\) · source: NVD
AF
Alp-tl00b Firmware · Huawei
before 10.0.0.162\(c01e156r1p4\) · source: NVD
AF
Anne-al00 Firmware · Huawei
before 9.1.0.126\(c00e126r1p7t8\) · source: NVD
AF
Ares-al00b Firmware · Huawei
before 9.1.0.165\(c00e165r2p5t8\) · source: NVD
AF
Ares-al10d Firmware · Huawei
before 9.1.0.165\(c00e165r2p5t8\) · source: NVD
AF
Ares-tl00chw Firmware · Huawei
before 8.2.0.163\(c01r2p1\) · source: NVD
BF
Barca-al00 Firmware · Huawei
before 8.0.0.377\(c00\) · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-2215
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-2215
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_CONFIRM
https://source.android.com/security/bulletin/2019-10-01
mailing-list
http://seclists.org/fulldisclosure/2019/Oct/38
x_refsource_MISC
http://packetstormsecurity.com/files/154911/Android-Binder-Use-After-Free.html
x_refsource_CONFIRM
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191030-01-binder-en
x_refsource_CONFIRM
https://security.netapp.com/advisory/ntap-20191031-0005/
mailing-list
https://seclists.org/bugtraq/2019/Nov/11
More from Android
9.6
CVE-2020-16010
Google Chrome for Android UI Heap Buffer Overflow Vulnerability
8.8
CVE-2026-58704
Google Pixel Improper Authorization Vulnerability
8.8
CVE-2025-48543
Android Runtime Use-After-Free Vulnerability
8.4
CVE-2025-48595
Android Framework Integer Overflow Vulnerability
7.8
CVE-2025-48572
Android Framework Privilege Escalation Vulnerability