CVE-2017-9696

CVE-2017-9696 describes a buffer over-read vulnerability in the camera driver function msm_isp_stop_stats_stream within Android for MSM, Firefox OS for MSM, and QRD Android releases utilizing the Linux kernel. This flaw arises because the num_streams variable, originating from user space, is not properly validated against the MSM_ISP_STATS_MAX limit. Rated with a CVSS score of 7.5 (HIGH), this vulnerability is network-exploitable with low attack complexity, potentially leading to high confidentiality impact without requiring user interaction. There is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.