---
id: "CVE-2026-124038"
page: "https://infrastack.ai/live/CVE-2026-124038"
kind: "vulnerability"
aliases: ["CVE-2026-124038"]
title: "Flock Installer for Android: XML expansion lets a crafted camera response crash the app"
severity: "low"
cvss: 2.3
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["android", "camera-installers", "flock-safety", "vendor"]
not_affected_if: ["android-13-or-later", "app-version-2.35.0-or-later"]
published_at: "2026-11-10T16:17:18+00:00"
first_seen_at: "2026-11-10T16:22:34+00:00"
updated_at: "2026-11-10T16:23:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124038", "first_seen_at": "2026-11-10T16:22:34+00:00"}]
exploit_sources: []
---

# Flock Installer for Android: XML expansion lets a crafted camera response crash the app

Link for people: https://infrastack.ai/live/CVE-2026-124038 (this .md is for agents)

The Flock Installer app for Android, before version 2.35.0, does not limit XML entity expansion, so a camera configuration response with nested entity declarations can crash the app. The sources say it does not expose or change data, and Android 13 and later reject the response.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Flock Installer app version on the Android device and compare it with `2.35.0`.
- Check the Android version on the device; the sources say Android 10, 11 or 12 are affected.

## Fix

- Flock Installer for Android: update to `2.35.0` or later.

## Timeline

- 2026-11-10T16:22:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124038

## From the sources

An uncontrolled XML entity expansion vulnerability in the Flock Installer app for Android before version 2.35.0 allows an attacker who has a valid technician account and controls or impersonates the camera being set up to crash the app, on devices running Android 10, 11 or 12, by returning a camera configuration response that contains nested XML entity declarations. The vulnerability does not allow the attacker to read or change data on the device, and no customer license plate, video or location data is exposed. Android 13 and later reject the response. The issue is fixed in version 2.35.0; update to 2.35.0 or later.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_