Is CVE-2011-1823 being actively exploited?

Yes. CVE-2011-1823 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on September 8, 2022.

What is the CVSS score for CVE-2011-1823?

CVE-2011-1823 has a CVSS 3.1 base score of 7.8 (HIGH).

CVE-2011-1823

HIGH · CVSS 7.8CISA KEV: actively exploitedEPSS 41.4%EU EUVD: exploited

The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket, which allows local users to execute arbitrary code and gain root privileges via a negative index that bypasses a maximum-only signed integer check in the DirectVolume::handlePartitionAdded method, which triggers memory corruption, as demonstrated by Gingerbreak.

Key facts

CVSS score: 7.8 (v3.1)
Severity: HIGH
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-190
EPSS score: 41.4% (99th percentile)
In CISA KEV: Yes, added September 8, 2022
In EU EUVD: Yes (EUVD-2011-1821)
Published: June 9, 2011
NVD last modified: June 16, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Android OS Privilege Escalation Vulnerability

Added to the KEV catalog on September 8, 2022; federal remediation due September 29, 2022.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2011-1821 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on October 22, 2025.

View on the EU Vulnerability Database

Affected products

google / android
google / android

References

http://android.git.kernel.org/?p=platform/system/core.git%3Ba=commit%3Bh=b620a0b1c7ae486e979826200e8e441605b0a5d6(Broken Link)
http://android.git.kernel.org/?p=platform/system/netd.git%3Ba=commit%3Bh=79b579c92afc08ab12c0a5788d61f2dd2934836f(Broken Link)
http://android.git.kernel.org/?p=platform/system/vold.git%3Ba=commit%3Bh=c51920c82463b240e2be0430849837d6fdc5352e(Broken Link)
http://androidcommunity.com/gingerbreak-root-for-gingerbread-app-20110421/(Broken Link)
http://c-skills.blogspot.com/2011/04/yummy-yummy-gingerbreak.html(Exploit, Issue Tracking)
http://forum.xda-developers.com/showthread.php?t=1044765(Exploit, Issue Tracking)
http://www.androidpolice.com/2011/05/03/google-patches-gingerbreak-exploit-but-dont-worry-we-still-have-root-for-now/(Press/Media Coverage)
http://xorl.wordpress.com/2011/04/28/android-vold-mpartminors-signedness-issue/(Exploit)
https://exchange.xforce.ibmcloud.com/vulnerabilities/67977(Third Party Advisory, VDB Entry)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2011-1823(US Government Resource)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain