CVE-2016-2418
CriticalSummary
The IOMX.cpp file in mediaserver in Android 6.x before 2016-04-01 does not initialize certain metadata buffer pointers, allowing attackers to obtain sensitive information from process memory.
Risk Assessment
Attackers may bypass an unspecified protection mechanism, potentially leading to data exposure such as Signature or SignatureOrSystem access.
Recommendation
It is recommended to update Android to a version after 2016-04-01 to mitigate this vulnerability.
Original NVD description (English source)
media/libmedia/IOMX.cpp in mediaserver in Android 6.x before 2016-04-01 does not initialize certain metadata buffer pointers, which allows attackers to obtain sensitive information from process memory, and consequently bypass an unspecified protection mechanism, via unspecified vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26324358.