CVE-2016-0803

Critical

Published: 07/02/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

libstagefright in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 has a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file. This issue affects the SoftMPEG4Encoder and SoftVPXEncoder components.

Risk Assessment

This vulnerability could lead to remote code execution, posing a serious security threat to Android devices. Attackers may exploit this flaw to gain control over the device or cause it to crash.

Recommendation

It is recommended to update the Android system to the latest version to mitigate this vulnerability. Additionally, avoid opening unknown media files from untrusted sources.

Original NVD description (English source)

libstagefright in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file that triggers a large memory allocation in the (1) SoftMPEG4Encoder or (2) SoftVPXEncoder component, aka internal bug 25812794.