Double free in Huawei Mate 9 Pro
Priority LOW 36CWE-415Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-415 and the CVSS impact.
Summary
Huawei Mate 9 Pro smartphones with software of LON-AL00BC00B139D, LON-AL00BC00B229, LON-L29DC721B188 have a memory double free vulnerability. The system does not manage the memory properly, that frees on the same memory address twice. An attacker tricks the user who has root privilege to install a crafted application, successful exploit could result in malicious code execution.
Why it matters now
EPSS 0.0099 62nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Huawei | Mate 9 Pro | LON-AL00BC00B139D, LON-AL00BC00B229, LON-L29DC721B188 | — | No fix listed | CNA |
- Mate 9 Pro VendorHuawei Affected LON-AL00BC00B139D, LON-AL00BC00B229, LON-L29DC721B188 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:huawei:mate_9_pro_firmware:lon-al00bc00b139d:*:*:*:*:*:*:* | lon-al00bc00b139d | Vulnerable | Huawei |
| cpe:2.3:o:huawei:mate_9_pro_firmware:lon-al00bc00b229:*:*:*:*:*:*:* | lon-al00bc00b229 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:mate_9_pro_firmware:lon-l29dc721b188:*:*:*:*:*:*:* | lon-l29dc721b188 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:mate_9_pro:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
- cpe:2.3:o:huawei:mate_9_pro_firmware:lon-al00bc00b139d:*:*:*:*:*:*:* Versions lon-al00bc00b139d Vulnerable ·Huawei
- cpe:2.3:o:huawei:mate_9_pro_firmware:lon-al00bc00b229:*:*:*:*:*:*:* Versions lon-al00bc00b229 Vulnerable ·Huawei
- cpe:2.3:o:huawei:mate_9_pro_firmware:lon-l29dc721b188:*:*:*:*:*:*:* Versions lon-l29dc721b188 Vulnerable ·Huawei
- cpe:2.3:h:huawei:mate_9_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-17320
- 2026-10-03 Alias added: GHSA-9w3x-5xrr-jfm6
References
More Huawei Mate 9 Pro Firmware vulnerabilities
- TI-2017-12641 Memory corruption in Huawei Mate 9 Pro CVSS 3.0HIGH 8.8
- TI-2017-11224 Memory corruption in Huawei Mate 10 CVSS 3.0HIGH 8.8
- TI-2017-12698 Integer overflow in Huawei Mate 9 Pro CVSS 3.0HIGH 7.8
- TI-2017-11229 Double free in Huawei Mate 9 CVSS 3.0HIGH 7.8
- TI-2017-05717 Use after free in Huawei Mate 9, Mate 9 Pro CVSS 3.0HIGH 7.8
- TI-2017-12620 Out-of-bounds write in Huawei Mate 9, Mate 9 Pro CVSS 3.0MEDIUM 6.7
Sources
- CVE-2017-17320 · CVE Program
- CVE-2017-17320 · NVD
- FIRST EPSS
- GHSA-9w3x-5xrr-jfm6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences