CVE-2016-0841

Critical

Published: 18/04/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

In Android versions 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before April 1, 2016, there is a bug in mediametadataretriever.cpp that mishandles cleared service binders. This allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file.

Risk Assessment

Organizations may be exposed to remote attacks that could lead to unauthorized code execution or system crashes, potentially resulting in data loss or service interruptions.

Recommendation

It is recommended to update the Android system to the latest version to mitigate this vulnerability and to monitor systems for suspicious activity related to media files.

Original NVD description (English source)

media/libmedia/mediametadataretriever.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 mishandles cleared service binders, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 26040840.