CVE-2015-3871

libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted…

published October 6, 2015

CVSS
—
EPSS
2%
Percentile
78.9
In the wild
Unconfirmed
What it is

⚠️ Android versions before 5.1.1 LMY48T have a vulnerability in libstagefright that allows crafty attackers to execute arbitrary code with just a media file! Think of it like a restaurant that serves food without checking the ingredients — anyone could slip in a dangerous item. An unsuspecting diner could end up with an unwanted surprise! If exploited, an attacker could run any code they desire on your device, leading to potential data theft or a complete denial of service! Imagine your phone suddenly freezing up, leaving you in the lurch — absolutely devastating!

Put simply

Think of it like a restaurant that serves food without checking the ingredients — anyone could slip in a dangerous item. An unsuspecting diner could end up with an unwanted surprise! This vulnerability exists in libstagefright, where specially crafted media files can cause memory corruption, allowing attackers to execute arbitrary code remotely without user interaction.

What to do

If exploited, an attacker could run any code they desire on your device, leading to potential data theft or a complete denial of service! Imagine your phone suddenly freezing up, leaving you in the lurch — absolutely devastating! To safeguard your device, ensure you update to Android versions 5.1.1 LMY48T or later. It's also wise to be cautious about the media files you open from unknown sources. Regular software updates can be your best friend here! You've got this! Stay vigilant, keep your devices updated, and you'll keep those pesky attackers at bay! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01858 · 78.9th percentile
Published
2015-10-06T17:00Z
EPSS history
Timeline
  • 06 OCT 17:00Z
    libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted…
    cvelistv5