CVE-2016-3918

CVE-2016-3918 is a medium-severity vulnerability affecting AOSP Mail in various Android versions, where a flaw in AttachmentProvider.java allows attackers to read arbitrary attachments. By crafting an application that provides a specific pathname value, an attacker can exploit this weakness due to the application not validating certain values as integers. The attack requires user interaction (UI:R) and local access (AV:L), but could lead to high confidentiality impact (C:H). There is no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this vulnerability.