CVE-2017-14888

CVE-2017-14888 is a heap buffer overflow vulnerability affecting Android for MSM, Firefox OS for MSM, and QRD Android releases from CAF using the Linux kernel. It occurs when userspace passes multiple append commands for Information Elements (IEs) to the host driver, causing an integer overflow in the length variable. This can lead to a subsequent heap buffer overflow during the IE data copy. With a CVSS score of 7.8 (High), this vulnerability allows for local exploitation with low attack complexity, potentially leading to high impact on confidentiality, integrity, and availability. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.