CVE-2017-0663

What it actually does

Memory corruption in libxml2 XML parsing allows arbitrary code execution within the context of an unprivileged process when a specially crafted file is processed.

Why it matters to the business

Attackers can execute code on affected devices by tricking users into opening malicious files, risking data exposure or further compromise across widely deployed mobile platforms.

How an attack unfolds

An attacker creates a malicious XML file that triggers the memory corruption during parsing; the file is delivered via common channels such as downloads or messaging, and execution occurs when a vulnerable application processes the file.

How to fix it

Apply the latest Android security updates that include fixes for the libxml2 component; verify devices are no longer running the listed vulnerable versions.

How to confirm the fix worked

Confirm Android builds incorporate the security patch addressing the libxml2 issue and test that crafted XML files no longer trigger unexpected code paths or crashes.

Typical attack path

1. Craft malicious XML file that exploits libxml2 memory corruption
2. Distribute file through user-accessible channels
3. Victim opens file in an affected application
4. Arbitrary code executes in unprivileged process context

How to detect it

Examine system and application logs for libxml2 parsing anomalies or crashes around the time of suspicious file access; correlate with process execution events following XML file handling.

What your security team should do

• Expedite deployment of Android security patches to all managed devices
• Restrict or monitor handling of untrusted XML files in enterprise applications
• Review application dependencies on libxml2 and prioritize updates