CVE-2015-6608 is a critical memory corruption vulnerability affecting the mediaserver component in Android 5.x before 5.1.1 LMY48X and Android 6.0 before the 2015-11-01 patch. This flaw allows remote attackers to execute arbitrary code or cause a denial of service simply by providing a specially crafted media file. With a CVSS score of 10.0, it represents a severe risk due to its network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, there is no public exploit code available in Metasploit, Nuclei, or ExploitDB, and community discussion and media coverage are limited, suggesting it is not widely exploited in the wild.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 5.0, < 5.1.1CPE matchmatch criteria | cpe:2.3:o:google:android:*:*:*:*:*:*:*:* | ||
6.0CPE matchmatch criteria | cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.