CVE-2018-9418 is a critical severity stack buffer overflow caused by a missing bounds check in the Bluetooth stack (handle_app_cur_val_response in dtif_rc.cc). NVD scores it 9.8. Google fixes it at security patch level 2018-07-05 or later. Install the device update that reaches that level.
What's affected
- Product: Android, in the Bluetooth stack (handle_app_cur_val_response in dtif_rc.cc).
- Releases listed by the bulletin: 7.0, 7.1.1, 7.1.2, 8.0 and 8.1. The NVD product list shows only some Android releases, so treat the bulletin as the fuller list.
- Fixed in: security patch level 2018-07-05 or later, according to the Pixel and Nexus Security Bulletin for July 2018.
- Impact in the record: remote code execution with no privileges and no user interaction.
- Severity: NVD scores it 9.8 Critical (vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The bulletin lists it as Moderate, type RCE. Both ratings are given because they differ.
- Weakness classes: CWE-787 (Out-of-bounds Write), CWE-120 (Classic Buffer Overflow).
How to check if you're exposed
- On the device, open Settings and find the Android security patch level, usually under About phone. The exact path varies by manufacturer. A date earlier than 2018-07-05 means the fix is not present.
- With a USB debugging connection, run
adb shell getprop ro.build.version.security_patch. It prints the patch level as a date. You need 2018-07-05 or later. - For a fleet, export the patch level from your mobile device management console and filter for dates earlier than 2018-07-05.
- Match each device against the release list above. Devices on releases outside it are not named for this CVE, but check them against the other entries in the same bulletin.
What to do now
- Identify every Android device in scope and record its current security patch level.
- Roll out the manufacturer or carrier update that reaches 2018-07-05 or later. Google publishes the fixes, but each device maker decides when its devices receive them.
- For devices that no longer receive updates, plan replacement or limit what they can reach, such as corporate mail and internal apps.
- Until patched, turn Bluetooth off when you do not need it and avoid pairing with unknown devices. This lowers exposure but does not replace the update.
- Write the update policy down, with a maximum patch age, and report exceptions.
Why it matters
The record scores this 9.8 (AV:N/AC:L/PR:N/UI:N), which is close to the top of the CVSS scale. Google labels the same issue Moderate in the Pixel and Nexus bulletin. That gap is worth reading closely, because it shows how much the rating depends on the platform mitigations assumed.
A stack buffer overflow happens when input is copied into a fixed size stack buffer without checking its length. The CVE is also tagged with an out-of-bounds write weakness. In native Bluetooth code, a remote peer controls the input, which is why the score is so high. The record's KEV flag is false, so CISA does not list it as exploited. That is the absence of a report in the sources read, not proof that no one has tried.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Both ratings cannot be right, can they?
They can, because they answer different questions. NVD scores the weakness in isolation at 9.8. The Pixel and Nexus bulletin lists the same issue as Moderate. Patch regardless of which label you start from.
Which patch level should I look for?
The Pixel and Nexus Security Bulletin for July 2018 places this fix at 2018-07-05. Any date at or after 2018-07-05 includes it. Some makers ship it under a different update name, so check the date.
Sources
- Pixel and Nexus Security Bulletin for July 2018: Affected releases, severity, type and the patch level that carries the fix.
Last reviewed: 19 October 2026.
