CVE-2015-3864 is an integer underflow vulnerability in the libstagefright component of Android's mediaserver, specifically affecting versions before 5.1.1 LMY48M. This flaw, an incomplete fix for a previous vulnerability, allows remote attackers to execute arbitrary code by crafting malicious MPEG-4 data. With a CVSS score of 10.0, it represents a critical risk, enabling unauthenticated attackers to achieve full compromise (confidentiality, integrity, and availability) with low attack complexity. The vulnerability has publicly available exploit code, including Metasploit modules and ExploitDB entries, and has garnered significant community discussion and media coverage, indicating widespread awareness and potential for exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 5.1CPE matchmatch criteria | cpe:2.3:o:google:android:*:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.