I'm curious about this vulnerability. I know that can execute code remotely and needs user interaction, but what type of interaction? Download the image? Copy it? I will appreciate if someone can answer me.

1 Answer 1


The file can be specifically crafted to trigger the malicious code when the user opens it (views it) on his device (local or via a received link).

The vulnerability associated with the PNG bug can be tracked as CVE-2019-1986, CVE-2019-1987, CVE-2019-1988.

CVE-2019-1986 – Uninitialized errors in SkPngCodec

CVE-2019-1987 – Heap buffer overflow

CVE-2019-1988 – Bug decoding JCS_RGB jpeg files

  • So, just view the image (by email or in a web site) trigger the infection?
    – Mycroft
    Apr 10, 2019 at 5:00
  • Yes. That is why it was considered highly dangerous.
    – Overmind
    Apr 10, 2019 at 5:02
  • Is update android or buy a new phone the only solutions?
    – Mycroft
    Apr 10, 2019 at 5:04
  • Officially, it is recommended to update, since the vulnerability was patched.
    – Overmind
    Apr 10, 2019 at 5:05
  • 1
    The problem is manufacturers delays to provide such updates
    – Mycroft
    Apr 10, 2019 at 5:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .