There is a race condition in Android for MSM, Firefox OS for MSM, and QRD Android that allows to access to already free'd memory in the debug message output functionality contained within the mobicore driver.
https://www.codeaurora.org/security-bulletin/2017/11/28/november-2017-security-bulletin
http://www.securityfocus.com/bid/100213
Source: Mitre, NVD
Published: 2018-03-30
Updated: 2026-06-17
Base Score: 1.9
Vector: CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:N
Severity: Low
Base Score: 4.7
Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity: Medium
EPSS: 0.00018