I'm curious about this vulnerability. I know that can execute code remotely and needs user interaction, but what type of interaction? Download the image? Copy it? I will appreciate if someone can answer me.


The file can be specifically crafted to trigger the malicious code when the user opens it (views it) on his device (local or via a received link).

The vulnerability associated with the PNG bug can be tracked as CVE-2019-1986, CVE-2019-1987, CVE-2019-1988.

CVE-2019-1986 – Uninitialized errors in SkPngCodec

CVE-2019-1987 – Heap buffer overflow

CVE-2019-1988 – Bug decoding JCS_RGB jpeg files

  • So, just view the image (by email or in a web site) trigger the infection? – Mycroft Apr 10 '19 at 5:00
  • Yes. That is why it was considered highly dangerous. – Overmind Apr 10 '19 at 5:02
  • Is update android or buy a new phone the only solutions? – Mycroft Apr 10 '19 at 5:04
  • Officially, it is recommended to update, since the vulnerability was patched. – Overmind Apr 10 '19 at 5:05
  • 1
    The problem is manufacturers delays to provide such updates – Mycroft Apr 10 '19 at 5:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.