CVE-2015-6599

libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted…

published October 6, 2015

CVSS
—
EPSS
2%
Percentile
78.9
In the wild
Unconfirmed
What it is

⚠️ A crafty media file is all it takes to leverage this vulnerability! Older Android versions before 5.1.1 LMY48T are at risk of remote code execution or a denial of service. 🔥 Think of it like a restaurant serving mystery meat without checking for allergies. A bad dish could send customers running for the door — similarly, a malicious media file can crash your device or execute harmful actions without your consent. An attacker could send you a cleverly crafted media file that, when played, leads to arbitrary code execution or even crashes your device unexpectedly. It's like inviting a surprise guest to your party who messes everything up!

Put simply

Think of it like a restaurant serving mystery meat without checking for allergies. A bad dish could send customers running for the door — similarly, a malicious media file can crash your device or execute harmful actions without your consent. This vulnerability in libstagefright allows attackers to exploit memory corruption from specially designed media files, enabling them to execute unauthorized code remotely or disrupt service.

What to do

An attacker could send you a cleverly crafted media file that, when played, leads to arbitrary code execution or even crashes your device unexpectedly. It's like inviting a surprise guest to your party who messes everything up! Make sure to update your Android device to version 5.1.1 LMY48T or later to avoid this risk. If you’re a developer, review your apps for any reliance on libstagefright and ensure they're patched accordingly. You've got this! Keeping your Android updated will help prevent sneaky exploits like this. 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01858 · 78.9th percentile
Published
2015-10-06T17:00Z
EPSS history
Timeline
  • 06 OCT 17:00Z
    libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted…
    cvelistv5