CVE-2016-3746

High

Published: 11/07/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Use-after-free vulnerability in the mm-video-v4l2 vdec component in mediaserver in Android before version 4.4.4, 5.0.2, 5.1.1, and 6.x before July 1, 2016 allows attackers to gain privileges via a crafted application.

Risk Assessment

Attackers can obtain Signature or SignatureOrSystem access, potentially leading to serious security breaches in the Android system.

Recommendation

It is recommended to update the Android system to the latest version to mitigate this vulnerability and to monitor applications from unknown sources.

Other vulnerabilities in mm-video-v4l2 vdec in mediaserver

CVE-2016-2479High
The mm-video-v4l2 vdec component in mediaserver in Android before version 4.4.4, 5.0.2, 5.1.1, and 6.x before June 1, 2016 mishandles a buffer count, allowing attackers to gain privileges via a crafted application.

Original NVD description (English source)

Use-after-free vulnerability in the mm-video-v4l2 vdec component in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27890802.