Uncontrolled XML Entity Expansion in Flock Installer for Android
CVE-2026-124038

1LOW

Key Information:

Vendor

Flock

Status
Flock Installer App
Vendor
CVE Published:
10 November 2026

Badges

👾 Exploit Exists

What is CVE-2026-124038?

The Flock Installer app for Android prior to version 2.35.0 contains an uncontrolled XML entity expansion vulnerability. This flaw permits an attacker with access to a valid technician account, who can leverage or impersonate the camera setup process, to potentially crash the application on devices running Android versions 10, 11, or 12. By sending crafted camera configuration responses containing nested XML entity declarations, the attack can disrupt the app's functionality. It is important to note that this vulnerability does not grant any access to personal data, such as customer license plates, video, or location information, as these remain secure. Users are strongly encouraged to update to version 2.35.0 or later to mitigate this issue.

Affected Version(s)

Flock Installer app Android 0 < 2.35.0

References

https://www.flocksafety.com/legal/security-advisories
vendor-advisory

CVSS V4

Score:
1
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lucas Franklin (https://nz.linkedin.com/in/lucas-franklin-723782343)
.