CVE-2018-9466 is a high severity out-of-bounds write in the bundled libxml2 library (xmlSnprintfElementContent in valid.c). NVD scores it 8.8. Google fixes it at security patch level 2018-09-01 or later. Install the device update that reaches that level. Check apps that bundle their own copy as well.
What's affected
- Product: Android, in the bundled libxml2 library (xmlSnprintfElementContent in valid.c).
- Releases listed by the bulletin: 7.0, 7.1.1, 7.1.2, 8.0 and 8.1. The NVD product list shows only some Android releases, so treat the bulletin as the fuller list.
- Fixed in: security patch level 2018-09-01 or later, according to the Android Security Bulletin for September 2018.
- Impact in the record: remote code execution in an unprivileged app, user interaction needed.
- Severity: NVD scores it 8.8 High (vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The bulletin lists it as High, type RCE. The two ratings agree.
- Weakness classes: CWE-787 (Out-of-bounds Write).
How to check if you're exposed
- On the device, open Settings and find the Android security patch level, usually under About phone. The exact path varies by manufacturer. A date earlier than 2018-09-01 means the fix is not present.
- With a USB debugging connection, run
adb shell getprop ro.build.version.security_patch. It prints the patch level as a date. You need 2018-09-01 or later. - For a fleet, export the patch level from your mobile device management console and filter for dates earlier than 2018-09-01.
- Match each device against the release list above. Devices on releases outside it are not named for this CVE, but check them against the other entries in the same bulletin.
- Apps can carry their own copy of libxml2. List the native libraries each app ships, for example from its software bill of materials, because the platform patch does not update them.
What to do now
- Identify every Android device in scope and record its current security patch level.
- Roll out the manufacturer or carrier update that reaches 2018-09-01 or later. Google publishes the fixes, but each device maker decides when its devices receive them.
- For devices that no longer receive updates, plan replacement or limit what they can reach, such as corporate mail and internal apps.
- Write the update policy down, with a maximum patch age, and report exceptions.
Why it matters
The affected code is libxml2, a library many projects bundle. The record also lists a NetApp advisory (ntap-20241108-0002). That page was not fetched for this post, so check it directly if you run NetApp products.
XML parsing is a classic place for memory bugs, because the parser builds strings and structures from untrusted documents. A write beyond a buffer while formatting element content is the kind of defect that fuzzing finds. The Android fix landed through the monthly bulletin, but any app that ships its own libxml2 copy depends on its own update. The record's KEV flag is false, so CISA does not list it as exploited. The bulletin says Google had no reports of active customer exploitation or abuse of the newly reported issues in it. That is the absence of a report in the sources read, not proof that no one has tried.
Quick check
Does patching Android fix my app bundled libxml2?
No. The platform patch covers the system library. An app that ships its own copy of libxml2 needs its own dependency update, which is where an inventory of bundled components helps.
Which patch level should I look for?
The Android Security Bulletin for September 2018 places this fix at 2018-09-01. Any date at or after 2018-09-01 includes it. Some makers ship it under a different update name, so check the date.
Sources
- Android Security Bulletin for September 2018: Affected releases, severity, type and the patch level that carries the fix.
Last reviewed: 19 October 2026.
