CVE-2018-5895

CVE-2018-5895 describes a buffer over-read vulnerability in the wma_process_utf_event() function within Android releases from CAF using the Linux kernel, specifically affecting Android for MSM, Firefox OS for MSM, and QRD Android before the 2018-06-05 security patch level. This flaw, categorized as CWE-125, could allow an attacker to read beyond the intended buffer due to insufficient length validation. Rated as Medium severity with a CVSS score of 5.5, the vulnerability requires local access and low privileges (AV:L/PR:L) but does not require user interaction (UI:N). A successful exploit could lead to high confidentiality impact (C:H) by allowing unauthorized information disclosure, though integrity and availability are not affected. There is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion is minimal, with only one mention, and there is no media coverage, indicating low public attention and a lack of widespread exploitation.