TI-2019-03734 Aliases CVE-2019-5305 GHSA-jj4j-prxw-rvrr

Double free in Huawei Mate 10

LOW 26CWE-415Published 2019-06-06 · Updated 2024-08-04

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-415 and the CVSS impact.

Summary

The image processing module of some Huawei Mate 10 smartphones versions before ALP-L29 9.0.0.159(C185) has a memory double free vulnerability. An attacker tricks a user into installing a malicious application, and the application can call special API, which could trigger double free and cause a system crash.

Why it matters now

EPSS 0.0056 46th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Huawei	Mate 10	The versions before ALP-L29 9.0.0.159(C185)	—	No fix listed	CNA

Mate 10 VendorHuawei Affected The versions before ALP-L29 9.0.0.159(C185) Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:huawei:mate_10_firmware::::::::	before alp-l29_9.0.0.159\(c185\)	Vulnerable	Huawei
cpe:2.3:h:huawei:mate_10:-:::::::*	not specified by NVD	Running on	Huawei

cpe:2.3:o:huawei:mate_10_firmware:*:*:*:*:*:*:*:* Versions before alp-l29_9.0.0.159\(c185\) Vulnerable ·Huawei
cpe:2.3:h:huawei:mate_10:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2019-5305
2026-10-03 Alias added: GHSA-jj4j-prxw-rvrr

References

Advisory 1

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190128-01-ivp-en

TI-2017-11224 Memory corruption in Huawei Mate 10 CVSS 3.0HIGH 8.8
TI-2018-05770 Use after free in HUAWEI Mate 10 CVSS 3.0HIGH 7.8
TI-2017-12643 Out-of-bounds read in Huawei Mate 10 CVSS 3.0HIGH 7.8
TI-2020-07330 There is a privilege escalation vulnerability on some Huawei smart phones due to design… CVSS 3.1MEDIUM 6.2
TI-2019-03654 Double free in Huawei Mate10 CVSS 3.0MEDIUM 5.5
TI-2019-03649 Use after free in Huawei Mate10 CVSS 3.0MEDIUM 5.5

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences