Android OS 8.1 'Oreo'
Android OS 8.1 'Oreo'
The Google Android OS 8.1 'Oreo' reached end of service life on Jan 10, 2021 — Google no longer ships security patches or fixes for it. Our third-party support keeps it safe to run: 24/7 engineers manage issues, remediate vulnerabilities, and help you maintain compliance.
24/7 engineers own your Android OS 8.1 'Oreo' incidents end to end.
Mitigation and patch-around guidance when the vendor no longer ships fixes.
Controls evidence and documentation that keep auditors satisfied.
Specifications
- product
- android
- release
- 8.1
- product Label
- Android OS
- release Label
- 8.1 'Oreo'
- codename
- Oreo
- lts
- latest Version
- release Date
- 2017-12-05
- maintained
- source Url
- https://endoflife.date/android
Lifecycle Dates
- End of Service Life
- Jan 10, 2021
- Last OEM Support
- Jan 10, 2021
OEM vs. 3rd Party Support
See how third-party support compares to the vendor contract for Android OS 8.1 'Oreo' — monitoring, break/fix, vulnerability work, operations and compliance, before and after EOSL.
| Feature | OEM Support | 3rd Party Support |
|---|---|---|
| Post-EOSL Support | ||
| Break/Fix Support | Until EOSL | |
| 24/7 Monitoring | ||
| Vulnerability Scanning & Remediation | ||
| Managed Operations | ||
| Procedure & Configuration Review | ||
| Compliance & Audit Documentation | Limited | |
| Discounted Migration to Other Platforms |
Why Choose 3rd Party Support for Android OS 8.1 'Oreo'?
Vulnerability Remediation
Scanning, mitigation and patch-around guidance for Android OS 8.1 'Oreo' when the vendor no longer ships fixes.
Compliance Maintenance
Procedure review, controls evidence and the documentation auditors ask for — maintained continuously, not scrambled at audit time.
24/7 Expert Support
Engineers who know this release monitor, manage and fix issues around the clock — break/fix to managed operations.
Android OS 8.1 'Oreo' Support: Frequently Asked Questions
Is the Google Android OS 8.1 'Oreo' still supported?
Google ended support for the Android OS 8.1 'Oreo' on Jan 10, 2021 — no more patches or fixes from the vendor. Third-party support keeps it covered: our engineers manage issues, remediate vulnerabilities, and help you maintain compliance for as long as you run it.
When is the Google Android OS 8.1 'Oreo' end of service life (EOSL) date?
Google lists the end of service life for the Android OS 8.1 'Oreo' as Jan 10, 2021.
Can I keep using the Android OS 8.1 'Oreo' after its EOSL date?
Yes. EOSL means Google stops issuing patches and support — the software itself keeps running. Third-party support covers it from there: issue management, security vulnerability remediation, and the compliance documentation auditors ask for, for as long as you choose to run it.
How much does third-party support for the Android OS 8.1 'Oreo' cost?
Typically 40-70% below the OEM maintenance renewal price. Exact pricing depends on quantity, service level and location — request a quote and we respond within 24 hours.
Known Vulnerabilities Affecting Android OS 8.1 'Oreo'
2688 published CVEs affect the Google Android OS 8.1 'Oreo', including 1804 rated critical or high severity. Google no longer ships security patches for this release — our engineers provide mitigation guidance, workarounds and hardening support.
| CVE | Severity | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-0124 | CRITICAL | 10.0 | Mar 10, 2026 | There is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2025-48611 | CRITICAL | 10.0 | Mar 10, 2026 | In DeviceId of DeviceId.java, there is a possible desync in persistence due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2017-13322 | CRITICAL | 10.0 | Jan 17, 2025 | In endCallForSubscriber of PhoneInterfaceManager.java, there is a possible way to prevent access to emergency services due to a logic error in the code. This could lead to a local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2024-47040 | CRITICAL | 10.0 | Dec 18, 2024 | There is a possible UAF due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2024-47038 | CRITICAL | 10.0 | Dec 18, 2024 | In dhd_prot_flowrings_pool_release of dhd_msgbuf.c, there is a possible outcof bounds write due to a missing bounds check. This could lead to localcescalation of privilege with no additional execution privileges needed. Usercinteraction is not needed for exploitation. |
| CVE-2018-9416 | CRITICAL | 10.0 | Dec 5, 2024 | In sg_remove_scat of scsi/sg.c, there is a possible memory corruption due to an unusual root cause. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2020-8899 | CRITICAL | 10.0 | May 6, 2020 | There is a buffer overwrite vulnerability in the Quram qmg library of Samsung's Android OS versions O(8.x), P(9.0) and Q(10.0). An unauthenticated, unauthorized attacker sending a specially crafted MMS to a vulnerable phone can trigger a heap-based buffer overflow in the Quram image codec leading to an arbitrary remote code execution (RCE) without any user interaction. The Samsung ID is SVE-2020-16747. |
| CVE-2026-0126 | CRITICAL | 9.8 | Jun 16, 2026 | In WC-Radio, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-0120 | CRITICAL | 9.8 | Mar 10, 2026 | In modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-0116 | CRITICAL | 9.8 | Mar 10, 2026 | In __mfc_handle_released_buf of mfc_core_isr.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-0114 | CRITICAL | 9.8 | Mar 10, 2026 | In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-0113 | CRITICAL | 9.8 | Mar 10, 2026 | In ns_GetUserData of ns_SmscbUtilities.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-0111 | CRITICAL | 9.8 | Mar 10, 2026 | In ns_GetUserData of ns_SmscbUtilities.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-0110 | CRITICAL | 9.8 | Mar 10, 2026 | In MM_DATA_IND of cn_NrSmMsgHdlrFromMM.cpp, there is a possible EoP due to memory corruption. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2025-36937 | CRITICAL | 9.8 | Dec 11, 2025 | In AudioDecoder::HandleProduceRequest of audio_decoder.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2025-36904 | CRITICAL | 9.8 | Sep 4, 2025 | WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-396458384. |
| CVE-2025-36897 | CRITICAL | 9.8 | Sep 4, 2025 | In unknown of cd_CnMsgCodecUserApi.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2025-36896 | CRITICAL | 9.8 | Sep 4, 2025 | WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-394765106. |
| CVE-2025-36890 | CRITICAL | 9.8 | Sep 4, 2025 | Elevation of Privilege |
| CVE-2024-53842 | CRITICAL | 9.8 | Jan 3, 2025 | In cc_SendCcImsInfoIndMsg of cc_MmConManagement.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. |
Showing the 20 most severe of 2688 known CVEs.
Get Third Party Support