Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-msku-25sz-rbeg
Vulnerability ID VCID-msku-25sz-rbeg
Aliases CVE-2017-0663
Summary A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses this library. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37104170.
Status Published
Exploitability 0.5
Weighted Severity 7.3
Risk 3.6
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-122 Heap-based Buffer Overflow
System Score Found at
cvssv3 8.1 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-0663.json
epss 0.00893 https://api.first.org/data/v1/epss?cve=CVE-2017-0663
epss 0.00893 https://api.first.org/data/v1/epss?cve=CVE-2017-0663
epss 0.00893 https://api.first.org/data/v1/epss?cve=CVE-2017-0663
cvssv2 6.8 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3 8.1 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-0663.json
https://api.first.org/data/v1/epss?cve=CVE-2017-0663
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0663
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7375
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7376
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9047
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9048
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9049
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9050
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
1462225 https://bugzilla.redhat.com/show_bug.cgi?id=1462225
870870 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=870870
USN-3424-1 https://usn.ubuntu.com/3424-1/
USN-3424-2 https://usn.ubuntu.com/3424-2/
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-0663.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.75948
EPSS Score 0.00893
Published At June 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T16:41:38.850101+00:00 Debian Importer Import https://security-tracker.debian.org/tracker/data/json 38.6.0