CVE-2016-0838
CriticalSummary
In Android 4.x before version 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before April 1, 2016, the Sonivox component in mediaserver does not check for a negative number of samples, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
Risk Assessment
This vulnerability poses a serious risk to organizations, allowing attackers to remotely take control of the system or disrupt its operation.
Recommendation
It is recommended to update the Android system to the latest version to mitigate this vulnerability and to monitor systems for suspicious activity related to media files.
Original NVD description (English source)
Sonivox in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not check for a negative number of samples, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, related to arm-wt-22k/lib_src/eas_wtengine.c and arm-wt-22k/lib_src/eas_wtsynth.c, aka internal bug 26366256.