CVE-2013-4739

The MSM camera driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to obtain sensitive information from kernel stack memory via (1) a crafted MSM_MCR_IOCTL_EVT_GET ioctl call, related to drivers/media/platform/msm/camera_v1/mercury/msm_mercury_sync.c, or (2) a crafted MSM_JPEG_IOCTL_EVT_GET ioctl call, related to drivers/media/platform/msm/camera_v2/jpeg_10/msm_jpeg_sync.c.

Published: 2014-02-02 Last update: 2026-06-16 Assigner: [email protected] Source: [email protected]

NVD Status：Modified，CVE State: published

View at NVD, CVE.org, EUVD

Threat Intelligence & Risk Assessment for CVE-2013-4739

EPSS CVSS CWE Affected OS Tracker

Conclusion & alert: CVE-2013-4739 is rated Low Risk (25.5/100): CVSS Medium severity, with low exploitation likelihood (EPSS 0.25%). Mandatory action: Monitor for updates and reassess as exploit intelligence or EPSS changes.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2013-4739

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-15	0.05%	0.25%	+0.20%
2	2025-03-30	0.17%	0.05%	-0.12%
3	2025-03-29	—	0.17%	—

Full EPSS history (6 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2013-4739

CVSS metrics for this CVE.

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
4.9	2.0	MEDIUM	`AV:L/AC:L/Au:N/C:C/I:N/A:N` Click to expand Access vector (AV:L) Requires local access to the target system. Access complexity (AC:L) Exploitation conditions are straightforward and predictable. Authentication (AU:N) No authentication is required. Confidentiality impact (C:C) Complete confidentiality impact. Integrity impact (I:N) No integrity impact. Availability impact (A:N) No availability impact.	3.9	6.9	[email protected]

Weakness enumeration for CVE-2013-4739

CWE-200 MITRE ↗

OS Trackers for CVE-2013-4739

vendor	priority	summary	link
`debian`	unimportant	CVE-2013-4739 unimportant priority: Debian including 1 source packages (linux), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5.	https://security-tracker.debian.org/tracker/CVE-2013-4739
`redhat`	—	—	https://access.redhat.com/security/cve/CVE-2013-4739
`ubuntu`	low	CVE-2013-4739 low priority: Ubuntu including 120 source packages (linux, linux-armadaxp, …), 1167 status rows across 17 suites (bionic, cosmic, disco, focal, jammy, lucid, noble, oracular, plucky, precise, quantal, questing, raring, saucy, trusty, upstream, xenial): DNE 815, not-affected 292, needed 36, ignored 24.	https://ubuntu.com/security/CVE-2013-4739

Affected software / configurations for CVE-2013-4739

Vendor	Product	Version	Raw CPE
codeaurora	android-msm	2.6.29	cpe:2.3:o:codeaurora:android-msm:2.6.29:::::::*
qualcomm	quic_mobile_station_modem_kernel	3.4	cpe:2.3:o:qualcomm:quic_mobile_station_modem_kernel:3.4:::::::*

References for CVE-2013-4739

URL	Tags
http://www.openwall.com/lists/oss-security/2013/10/15/4
https://www.codeaurora.org/projects/security-advisories/stack-based-buffer-overflow-and-memory-disclosure-camera-driver-cve-2013-4748-cve-2013-4739	Vendor Advisory

cvelogic Threat Intelligence