CVE-2015-6603

libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted…

published October 6, 2015

CVSS
—
EPSS
2%
Percentile
79.1
In the wild
Unconfirmed
What it is

⚠️ A crafty media file could lead to a disastrous memory corruption in Android versions before 5.1.1! If your device is running an outdated version, you might just be a click away from chaos! Think of libstagefright as a movie theater that lets in anyone with a ticket, regardless of whether it’s valid or not. If a particularly chaotic film is played, it could cause a total meltdown in the projection room. An attacker could exploit this vulnerability to run arbitrary code on your device or cause a total denial of service. Imagine your phone crashing or worse, handing over control to someone else! That's absolutely devastating for your data and privacy.

Put simply

Think of libstagefright as a movie theater that lets in anyone with a ticket, regardless of whether it’s valid or not. If a particularly chaotic film is played, it could cause a total meltdown in the projection room. This vulnerability in libstagefright allows remote attackers to exploit memory corruption by using a specially crafted media file, leading to unauthorized code execution.

What to do

An attacker could exploit this vulnerability to run arbitrary code on your device or cause a total denial of service. Imagine your phone crashing or worse, handing over control to someone else! That's absolutely devastating for your data and privacy. To protect yourself, make sure your Android device is updated to version 5.1.1 or later. Regularly check for system updates to stay ahead of potential threats. You've got this! Stay vigilant and keep your device updated for a safer experience. 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01858 · 79.1th percentile
Published
2015-10-06T17:00Z
EPSS history
Timeline
  • 06 OCT 17:00Z
    libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted…
    cvelistv5