---
id: CVE-2017-0663
title: >-
  A remote code execution vulnerability in libxml2 could enable an attacker
  using a specially crafted file to execute arbitrary code within the context of
  an unprivileged process
summary: >-
  A remote code execution vulnerability in libxml2 could enable an attacker
  using a specially crafted file to execute arbitrary code within the context of
  an unprivileged process. This issue is rated as High due to the possibility of
  remot…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-787
vendor: google
product: android
affected:
  - android = 4.4.4
  - android = 5.0.2
  - android = 5.1.1
  - android = 6.0
  - android = 6.0.1
  - android = 7.0
  - android = 7.1.1
  - android = 7.1.2
published: '2017-06-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T07:16:39.053'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2017-0663'
references:
  - url: 'http://www.debian.org/security/2017/dsa-3952'
    label: security@android.com
  - url: 'http://www.securityfocus.com/bid/98877'
    label: security@android.com
  - url: 'http://www.securitytracker.com/id/1038623'
    label: security@android.com
  - url: >-
      https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
    label: security@android.com
  - url: >-
      https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
    label: security@android.com
  - url: 'https://security.gentoo.org/glsa/201711-01'
    label: security@android.com
  - url: 'https://source.android.com/security/bulletin/2017-06-01'
    label: security@android.com
  - url: 'http://www.debian.org/security/2017/dsa-3952'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.securityfocus.com/bid/98877'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.securitytracker.com/id/1038623'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.gentoo.org/glsa/201711-01'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://source.android.com/security/bulletin/2017-06-01'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.02318
epssPercentile: 0.83286
ingestedAt: '2026-10-14T07:21:04.797Z'
---

## Overview

A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses this library. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37104170.

## Affected

- `android = 4.4.4`
- `android = 5.0.2`
- `android = 5.1.1`
- `android = 6.0`
- `android = 6.0.1`
- `android = 7.0`
- `android = 7.1.1`
- `android = 7.1.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.