CVE-2016-2451

CVE-2016-2451 is a privilege escalation vulnerability in the libstagefright component of Android versions 4.x, 5.0.x, 5.1.x, and 6.x prior to their respective patches. It stems from a lack of VPX output buffer size validation, allowing a crafted application to gain elevated privileges, such as Signature or SignatureOrSystem access. With a CVSS score of 7.8 (High), this vulnerability requires user interaction (UI:R) and local access (AV:L) to exploit, but can lead to high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). There is no evidence of active exploitation, publicly available exploit code, or significant community discussion, though it was covered by SecurityWeek.