Memory corruption in Huawei P10 Plus,P10
Priority LOW 39CWE-119Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.
Summary
Bastet in P10 Plus and P10 smart phones with software earlier than VKY-AL00C00B123 versions, earlier than VTR-AL00C00B123 versions have a buffer overflow vulnerability. An attacker with the root privilege of an Android system may trick a user into installing a malicious APP. The APP can modify specific data to cause buffer overflow in the next system reboot, causing continuous system reboot or arbitrary code execution.
Why it matters now
EPSS 0.01351 71st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Huawei | P10 Plus,P10 | Eariler than VKY-AL00C00B123 verisons,Earlier than VTR-AL00C00B123 versions | — | No fix listed | CNA |
- P10 Plus,P10 VendorHuawei Affected Eariler than VKY-AL00C00B123 verisons,Earlier than VTR-AL00C00B123 versions Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:huawei:p10_firmware:*:*:*:*:*:*:*:* | before vtr-al00c00b123 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:p10:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:p10_plus_firmware:*:*:*:*:*:*:*:* | before vky-al00c00b123 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:p10_plus:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
- cpe:2.3:o:huawei:p10_firmware:*:*:*:*:*:*:*:* Versions before vtr-al00c00b123 Vulnerable ·Huawei
- cpe:2.3:h:huawei:p10:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:p10_plus_firmware:*:*:*:*:*:*:*:* Versions before vky-al00c00b123 Vulnerable ·Huawei
- cpe:2.3:h:huawei:p10_plus:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-2724
- 2026-10-03 Alias added: GHSA-jcx6-9vqr-gv6h
References
More Huawei P10 Firmware vulnerabilities
- TI-2017-01968 Memory corruption in Huawei P10 Plus,P10 CVSS 3.0HIGH 8.4
- TI-2017-01967 Memory corruption in Huawei P10 Plus,P10 CVSS 3.0HIGH 7.8
- TI-2017-05725 Memory corruption in Huawei P10, P10 Plus CVSS 3.0HIGH 7.8
- TI-2017-05747 Improper array index validation in Huawei P10 Plus,P10 CVSS 3.0MEDIUM 5.5
- TI-2017-05721 Improper input validation in Huawei P10, P10 Plus CVSS 3.0MEDIUM 5.5
- TI-2017-05720 Improper input validation in Huawei P10, P10 Plus CVSS 3.0MEDIUM 5.5
Sources
- CVE-2017-2724 · CVE Program
- CVE-2017-2724 · NVD
- FIRST EPSS
- GHSA-jcx6-9vqr-gv6h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences