CVE-2015-3872

libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted…

published October 6, 2015

CVSS
—
EPSS
2%
Percentile
78.9
In the wild
Unconfirmed
What it is

⚠️ A crafted media file could send your Android device spiraling! Before version 5.1.1 LMY48T, libstagefright is vulnerable to a sneaky attack that can lead to chaos. 🔥 Think of it as ordering a meal where the chef decides to add a mysterious ingredient without checking if it’s safe — one wrong file and your whole device could start acting weird, or worse, stop functioning altogether! An attacker could exploit this vulnerability to execute arbitrary code, potentially taking control of your device, or they could cause a denial of service, rendering your phone unusable at the worst possible moment. It's a recipe for frustration, especially when you need your device the most!

Put simply

Think of it as ordering a meal where the chef decides to add a mysterious ingredient without checking if it’s safe — one wrong file and your whole device could start acting weird, or worse, stop functioning altogether! This vulnerability arises in libstagefright, allowing attackers to exploit memory corruption by sending specially crafted media files to devices running Android versions before 5.1.1 LMY48T.

What to do

An attacker could exploit this vulnerability to execute arbitrary code, potentially taking control of your device, or they could cause a denial of service, rendering your phone unusable at the worst possible moment. It's a recipe for frustration, especially when you need your device the most! Ensure you update your Android device to version 5.1.1 LMY48T or later to patch this flaw. If you're a developer, be mindful that using older versions of libstagefright can expose your apps to similar risks — make sure your dependencies are current! You've got this! Stay updated and keep your devices safe! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01858 · 78.9th percentile
Published
2015-10-06T17:00Z
EPSS history
Timeline
  • 06 OCT 17:00Z
    libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted…
    cvelistv5