CVE-2016-6699: Buffer Overflow
A remote code execution vulnerability in libstagefright in Mediaserver in Android 7.0 before 2016-11-01 could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Android ID: A-31373622.
Affected Software
Remediation
Event History
Frequently Asked Questions
Which Android versions are affected?
The issue affects Android 7.0 builds with security updates from before 2016-11-01. The provided data identifies Google Android as the affected software.
What must an attacker do to exploit this vulnerability?
An attacker needs to induce processing of a specially crafted media file or media data. Successful processing can corrupt memory and may allow code execution in the Mediaserver process.
Is user interaction required?
Yes. The CVSS vector includes UI:R, indicating that user interaction is required for exploitation.
What should organizations do if they identify an affected device?
Apply the available patch, specifically an Android security update dated 2016-11-01 or later. The provided remedy states that a patch is available.