# CVE-2026-124038: Uncontrolled XML entity expansion in the Flock Installer app for Android

Status: published. Published: 2026-11-10. Updated: 2026-11-10.

An uncontrolled XML entity expansion vulnerability in the Flock Installer app for Android before version 2.35.0 allows an attacker who has a valid technician account and controls or impersonates the camera being set up to crash the app, on devices running Android 10, 11 or 12, by returning a camera configuration response that contains nested XML entity declarations. The vulnerability does not allow the attacker to read or change data on the device, and no customer license plate, video or location data is exposed. Android 13 and later reject the response. The issue is fixed in version 2.35.0; update to 2.35.0 or later.

## Remediation

- fix: Update the Flock Installer app to version 2.35.0 or later from Google Play. Customers don't need to take any action; the app is used by Flock technicians, whose phones receive the update through Google Play. (source: CNA: flock)

## Affected products and versions

- Flock / Flock Installer app: ≥ 0; < 2.35.0 (affected, custom). Source: CNA: flock; platforms: Android

## Severity and prioritization

- CVSS 4.0: 1 (low); CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N; source: CNA: flock

- CVSS 3.1: 2.3 (low); CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L; source: CNA: flock

- CVSS 4.0: 1 (low); CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X; source: NVD: 12dd0b25-a5e8-4486-84b1-59c4a6ebd552

- CVSS 3.1: 2.3 (low); CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L; source: NVD: 12dd0b25-a5e8-4486-84b1-59c4a6ebd552

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-776

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://www.flocksafety.com/legal/security-advisories (CNA: flock; vendor-advisory)

- https://www.flocksafety.com/legal/security-advisories (12dd0b25-a5e8-4486-84b1-59c4a6ebd552)

## Provenance

- CNA: flock: https://www.cve.org/CVERecord?id=CVE-2026-124038; retrieved 2026-11-10; source updated 2026-11-10

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-124038; retrieved 2026-11-10; source updated 2026-11-10

Revision: ebb4cac53183ba3fc5decabbd64a42f25f284897a50080cfeea17ebed0a2fc6e

Canonical: https://y2.dev/cve/CVE-2026-124038

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.