CVE-2016-0837

Critical

Published: 18/04/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

A vulnerability in libstagefright in mediaserver in Android allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file. This affects Android versions 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before April 1, 2016.

Risk Assessment

Organizations using vulnerable versions of Android may be exposed to remote attacks that could lead to unauthorized system access or disruption of service.

Recommendation

It is recommended to update Android to the latest version to mitigate this vulnerability and to monitor for any suspicious media files.

Original NVD description (English source)

MPEG4Extractor.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read and memory corruption) via a crafted media file, aka internal bug 27208621.