Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Android MediaServer video decoder can grant apps extra privileges

CVE-2016-2479 · published 10 years ago
Summary

The video decoding component of Android's MediaServer mishandles internal data, letting a specially crafted app gain higher system rights. This affects Android versions 4.x through 6.x before their respective patches. Update devices to the latest Android releases or apply the vendor's security patch to close the gap.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
google android 4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1
4.1.1
4.1.2
4.2
4.2.1
4.2.2
4.3
6 more version ranges
cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*
Original advisory text
The mm-video-v4l2 vdec component in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 mishandles a buffer count, which allows attackers to g...
The mm-video-v4l2 vdec component in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 mishandles a buffer count, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27532282.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-119Buffer Overflow
Timeline
Published13 Jun 2016
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2016-2479 · NVD
Track software like this
Free during beta