CVE-2016-2484

CVE-2016-2484 is a critical vulnerability affecting the libstagefright component within the mediaserver in various Android versions (4.x, 5.0.x, 5.1.x, and 6.x prior to June 2016). It stems from a lack of validation for OMX buffer sizes when processing GSM and G711 codecs. This flaw allows a malicious application to achieve privilege escalation, potentially gaining Signature or SignatureOrSystem access. With a CVSS score of 7.8 (High), this vulnerability is locally exploitable with low attack complexity, requiring user interaction to install a crafted application, and can lead to high impact across confidentiality, integrity, and availability. While no public exploit code or active exploitation has been observed, and it's not listed in CISA's KEV catalog, it did receive some media coverage and community discussion at the time of its disclosure.