Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2017-0466: Android Media Server can run attacker code
CVE-2017-0466 · published 9 years ago
Summary
The Android Media Server component in versions 6.0 through 7.1.1 can be tricked by a specially crafted media file to corrupt memory and execute code. This could let an attacker take control of the device or access sensitive data. Update the device to the latest security patches or apply vendor updates to fix the issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| android |
6.0 6.0.1 7.0 7.1.0 7.1.1 cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:* |
Original advisory text
A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as...
A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33139050.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-119Buffer Overflow
Timeline
Published8 Mar 2017
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2017-0466 · NVD
Track software like this
Free during beta