CVE-2016-2428
CriticalSummary
In libAACdec in mediaserver in Android before version 4.4.4, 5.0.2, 5.1.1, and before May 1, 2016, the number of threads is not properly limited, allowing remote attackers to execute arbitrary code or cause a denial of service via a crafted media file.
Risk Assessment
An attacker could exploit this vulnerability to remotely execute code, posing a serious threat to the security of the system and user data.
Recommendation
It is recommended to update the Android system to the latest version to mitigate this vulnerability and reduce the risk of remote attacks.
Original NVD description (English source)
libAACdec/src/aacdec_drc.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not properly limit the number of threads, which allows remote attackers to execute arbitrary code or cause a denial of service (stack memory corruption) via a crafted media file, aka internal bug 26751339.