CVE-2016-0839
CriticalSummary
The post_proc/volume_listener.c file in mediaserver in Android 6.x before 2016-04-01 mishandles deleted effect context, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
Risk Assessment
Organizations may be exposed to remote attacks that could lead to unauthorized code execution or system crashes, potentially resulting in data loss or service interruptions.
Recommendation
It is recommended to update Android to a version after 2016-04-01 to mitigate this vulnerability and to monitor and restrict access to unknown media files.
Original NVD description (English source)
post_proc/volume_listener.c in mediaserver in Android 6.x before 2016-04-01 mishandles deleted effect context, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 25753245.