PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-0408 Google CVE debrief

CVE-2017-0408 is a high-severity remote code execution issue described in Android's security bulletin for libgdx. According to the published advisory, a specially crafted file could allow arbitrary code execution in the context of an unprivileged process.

Vendor
Google
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-08
Original CVE updated
2026-05-13
Advisory published
2017-02-08
Advisory updated
2026-05-13

Who should care

Android security teams, application maintainers that bundle or rely on libgdx, and operators of apps that parse untrusted files should care most. The published Android bulletin and NVD entry indicate this affects Android 7.1.1 and may be triggered through file handling.

Technical summary

The published description states that libgdx can be exploited with a specially crafted file to execute arbitrary code in an unprivileged process. NVD lists the affected CPE as Android 7.1.1 and assigns CVSS 3.0 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, which indicates local attack conditions and required user interaction despite the remote code execution impact language. NVD also marks the weakness as NVD-CWE-noinfo.

Defensive priority

High. The issue is rated HIGH in the source corpus and has confidentiality, integrity, and availability impact at the CVSS high level. Prioritize patching where Android 7.1.1 or vulnerable libgdx-based applications are still in use, especially if they process untrusted files.

Recommended defensive actions

  • Review whether any products or apps in your environment use libgdx or Android 7.1.1 components implicated by the advisory.
  • Apply the relevant Android security bulletin fixes or vendor patches referenced for this issue.
  • Reduce exposure to untrusted or specially crafted files until patched systems are confirmed.
  • Validate that affected applications are updated and that old Android 7.1.1 builds are retired where possible.
  • Use least privilege and limit file ingestion paths for applications that must remain in service.

Evidence notes

Primary evidence comes from the Android security bulletin linked in the NVD record and from the NVD CVE detail. The source corpus describes a crafted-file-triggered arbitrary code execution issue in libgdx, and NVD provides the affected Android 7.1.1 CPE plus the CVSS 3.0 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. No exploit details are included here beyond the published advisory language.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-0408 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-0408

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-0408 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-0408

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.