CVE-2016-3840

Critical

Published: 05/08/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Conscrypt in Android versions 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-05 does not properly identify session reuse, allowing remote attackers to execute arbitrary code via unspecified vectors.

Risk Assessment

This vulnerability poses a risk of remote code execution, potentially leading to device takeover and data leakage.

Recommendation

It is recommended to update the Android system to the latest version to mitigate this vulnerability.

Original NVD description (English source)

Conscrypt in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-05 does not properly identify session reuse, which allows remote attackers to execute arbitrary code via unspecified vectors, aka internal bug 28751153.