CVE-2016-0804

Critical

Published: 07/02/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The NuPlayer::GenericSource::notifyPreparedAndCleanup function in mediaserver in Android 5.x before version 5.1.1 LMY49G and 6.x before 2016-02-01 improperly manages mDrmManagerClient objects. This allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file.

Risk Assessment

This vulnerability can lead to serious consequences, such as remote code execution or system crashes, posing a threat to data security and device stability.

Recommendation

It is recommended to update Android to version 5.1.1 LMY49G or later to mitigate this vulnerability and to monitor the use of media files to detect potential attacks.

Original NVD description (English source)

The NuPlayer::GenericSource::notifyPreparedAndCleanup function in media/libmediaplayerservice/nuplayer/GenericSource.cpp in mediaserver in Android 5.x before 5.1.1 LMY49G and 6.x before 2016-02-01 improperly manages mDrmManagerClient objects, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 25070434.