Use after free in Huawei Vicky-AL00A,Vicky-AL00C,Vicky-TL00A,Victoria-AL00A,Victoria-TL00A
Priority LOW 36CWE-416Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.
Summary
The Madapt Driver of some Huawei smart phones with software Earlier than Vicky-AL00AC00B172 versions,Vicky-AL00CC768B122,Vicky-TL00AC01B167,Earlier than Victoria-AL00AC00B172 versions,Victoria-TL00AC00B123,Victoria-TL00AC01B167 has a use after free (UAF) vulnerability. An attacker can trick a user to install a malicious application which has a high privilege to exploit this vulnerability, Successful exploitation may cause arbitrary code execution.
Why it matters now
EPSS 0.01067 64th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Huawei | Vicky-AL00A,Vicky-AL00C,Vicky-TL00A,Victoria-AL00A,Victoria-TL00A | Earlier than Vicky-AL00AC00B172 versions,Vicky-AL00CC768B122,Vicky-TL00AC01B167,Earlier than Victoria-AL00AC00B172 versions,Victoria-TL00AC00B123,Victoria-TL00AC01B167 | — | No fix listed | CNA |
- Vicky-AL00A,Vicky-AL00C,Vicky-TL00A,Victoria-AL00A,Victoria-TL00A VendorHuawei Affected Earlier than Vicky-AL00AC00B172 versions,Vicky-AL00CC768B122,Vicky-TL00AC01B167,Earlier than Victoria-AL00AC00B172 versions,Victoria-TL00AC00B123,Victoria-TL00AC01B167 Fixed in — No fix listed CNA
CPE configurations NVD · 11
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:huawei:vicky-al00a_firmware:*:*:*:*:*:*:*:* | before vicky-al00ac00b172 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:vicky-al00a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:vicky-al00c_firmware:vicky-al00cc768b122:*:*:*:*:*:*:* | vicky-al00cc768b122 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:vicky-al00c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:vicky-tl00a_firmware:vicky-tl00ac01b167:*:*:*:*:*:*:* | vicky-tl00ac01b167 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:vicky-tl00a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:victoria-al00a_firmware:*:*:*:*:*:*:*:* | before victoria-al00ac00b172_ | Vulnerable | Huawei |
| cpe:2.3:h:huawei:victoria-al00a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:victoria-tl00a_firmware:victoria-tl00ac00b123:*:*:*:*:*:*:* | victoria-tl00ac00b123 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:victoria-tl00a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
- cpe:2.3:o:huawei:vicky-al00a_firmware:*:*:*:*:*:*:*:* Versions before vicky-al00ac00b172 Vulnerable ·Huawei
- cpe:2.3:h:huawei:vicky-al00a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:vicky-al00c_firmware:vicky-al00cc768b122:*:*:*:*:*:*:* Versions vicky-al00cc768b122 Vulnerable ·Huawei
- cpe:2.3:h:huawei:vicky-al00c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:vicky-tl00a_firmware:vicky-tl00ac01b167:*:*:*:*:*:*:* Versions vicky-tl00ac01b167 Vulnerable ·Huawei
- cpe:2.3:h:huawei:vicky-tl00a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:victoria-al00a_firmware:*:*:*:*:*:*:*:* Versions before victoria-al00ac00b172_ Vulnerable ·Huawei
- cpe:2.3:h:huawei:victoria-al00a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:victoria-tl00a_firmware:victoria-tl00ac00b123:*:*:*:*:*:*:* Versions victoria-tl00ac00b123 Vulnerable ·Huawei
- cpe:2.3:h:huawei:victoria-tl00a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-8160
- 2026-10-03 Alias added: GHSA-93qj-fvc7-c37j
References
More Huawei Vicky-al00a Firmware vulnerabilities
- TI-2017-11243 Double free in Huawei Vicky-AL00A CVSS 3.0MEDIUM 5.5
- TI-2017-05748 Maya-L02,VKY-L09,VTR-L29,Vicky-AL00A,Victoria-AL00A,Warsaw-AL00 smart phones with… CVSS 3.0MEDIUM 4.6
Sources
- CVE-2017-8160 · CVE Program
- CVE-2017-8160 · NVD
- FIRST EPSS
- GHSA-93qj-fvc7-c37j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences