CVE-2015-6601

libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted…

published October 6, 2015

CVSS
—
EPSS
2%
Percentile
78.9
In the wild
Unconfirmed
What it is

⚠️ A crafted media file is all it takes to exploit this vulnerability in Android's libstagefright! 💥 Think of it like a movie theater that allows anyone to sneak in a film reel without checking it first — it might just show a blockbuster or crash the projector altogether. 🎥 An attacker could remotely execute arbitrary code, or worse, cause a denial of service that disrupts user experiences. This could lead to anything from unexpected crashes to a potential breach, leaving devices vulnerable and users frustrated. Yikes!

Put simply

Think of it like a movie theater that allows anyone to sneak in a film reel without checking it first — it might just show a blockbuster or crash the projector altogether. 🎥 This vulnerability exists in libstagefright, allowing attackers to trigger memory corruption by delivering specifically crafted media files, which can lead to arbitrary code execution on devices running affected Android versions.

What to do

An attacker could remotely execute arbitrary code, or worse, cause a denial of service that disrupts user experiences. This could lead to anything from unexpected crashes to a potential breach, leaving devices vulnerable and users frustrated. Yikes! To protect your devices, update your Android system to version 5.1.1 LMY48T or later. Regularly check for system updates, and consider disabling multimedia playback from untrusted sources to mitigate risks. You've got this! Stay safe and keep your devices updated to fend off these potential threats. 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01858 · 78.9th percentile
Published
2015-10-06T17:00Z
EPSS history
Timeline
  • 06 OCT 17:00Z
    libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted…
    cvelistv5