Back
CVE-2014-7953
Race condition in the bindBackupAgent method in the ActivityManagerService in Android 4.4.4 allows local users with adb shell access to…
High7.0EPSS 0.33%
- Published
- Updated
- Reserved
- Assigned by
- mitre
Description
Race condition in the bindBackupAgent method in the ActivityManagerService in Android 4.4.4 allows local users with adb shell access to execute arbitrary code or any valid package as system by running "pm install" with the target apk, and simultaneously running a crafted script to process logcat's output looking for a dexopt line, which once found should execute bindBackupAgent with the uid member of the ApplicationInfo parameter set to 1000.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.0 | High7.0 | CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.33% · top 74% of all CVEs (3 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.0.
Weakness
Affected products
n/a
- affected n/a
References (4)
- https://android.googlesource.com/platform/frameworks/base/+/a8f6d1b%5E%21/ (opens in a new tab)x_refsource_CONFIRMx_transferred
- 20150417 CVE-2014-7953 Android backup agent code execution (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
- 20150417 CVE-2014-7953 Android backup agent code execution (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
- 74213 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2014-7953)Record last updated .