HIGH✓ PATCH🇬🇧 English

CVE-2015-3864

CVSS 10.0v2.0pub. 2015-10-01upd. 2026-05-06

Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted MPEG-4 data, aka internal bug 23034759. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3824.

oryginał EN
CVSS Vector
AV:N/AC:L/Au:N/C:C/I:C/A:C

  • Google Android

    OS
    Google
    ≤ 5.1
🟢
PATCH DOSTĘPNY
Aktualizacja od producenta gotowa. Wdrożenie w ramach standardowego cyklu.
Tagi
RCE
CWE
Referencje

Powiązane podatności

CVE-2020-16010CRITICAL9.6⚠ KEVPL ✓ten sam produkt

Heap buffer overflow w Google Chrome na Android — sandbox escape

CVE-2016-1019CRITICAL9.8⚠ KEVPL ✓ten sam produkt

Adobe Flash Player — RCE lub DoS przez nieokreślone wektory ataku

CVE-2026-78937CRITICAL9.6ten sam produkt

Use after free in Search in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker lever...

CVE-2026-76036CRITICAL9.6ten sam produkt

Buffer overflow in Dawn in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker to ex...

CVE-2026-19157CRITICAL9.6PL ✓ten sam produkt

Out-of-bounds write w ANGLE umożliwia sandbox escape w Chrome na Android