CVE-2026-124038 · Vendor
NO FIX YET · SEE WHAT TO DO
The Flock Installer app for Android, before version 2.35.0, does not limit XML entity expansion, so a camera configuration response with nested entity declarations can crash the app. The sources say it does not expose or change data, and Android 13 and later reject the response.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only the Flock Installer app on Android 10, 11 or 12 is affected, and the attacker must hold a valid technician account and control or impersonate the camera being set up. Devices on Android 13 or later reject the malicious response, and the sources say no customer license plate, video or location data is exposed.
Not affected if android-13-or-later, app-version-2.35.0-or-later
Who cares android, camera-installers, flock-safety
2.35.0.2.35.0 or later.An uncontrolled XML entity expansion vulnerability in the Flock Installer app for Android before version 2.35.0 allows an attacker who has a valid technician account and controls or impersonates the camera being set up to crash the app, on devices running Android 10, 11 or 12, by returning a camera configuration response that contains nested XML entity declarations. The vulnerability does not allow the attacker to read or change data on the device, and no customer license plate, video or location data is exposed. Android 13 and later reject the response. The issue is fixed in version 2.35.0; update to 2.35.0 or later.
This page as .md · .json · CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.