CVE-2020-0033 describes a high-severity out-of-bounds write vulnerability in the CryptoPlugin::decrypt function within Android versions 8.0 through 10. This flaw allows for local escalation of privilege without requiring user interaction or additional execution privileges. With a CVSS score of 7.8, the vulnerability presents a significant risk, potentially leading to high impact on confidentiality, integrity, and availability. While not listed on CISA's KEV catalog, there is no public exploit code available in Metasploit, Nuclei, or ExploitDB, and community discussion is limited, though it did receive media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
8.0CPE matchmatch criteria | cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:* | ||
8.1CPE matchmatch criteria | cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:* | ||
9.0CPE matchmatch criteria | cpe:2.3:o:google:android:9.0:*:*:*:*:*:*:* | ||
10.0CPE matchmatch criteria | cpe:2.3:o:google:android:10.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.