CVE-2016-2417

critical

Published 2016-04-18 · Modified 2026-05-06

CVSS v3

9.8

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2

10.0

VIR risk

9.8

Description

media/libmedia/IOMX.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not initialize a parameter data structure, which allows attackers to obtain sensitive information from process memory, and consequently bypass an unspecified protection mechanism, via unspecified vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26914474.

Predictions

Exploit likelihood

97%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: security@android.com — http://source.android.com/security/bulletin/2016-04-02.html

Exploits

Exploit-DB

EDB-39685 · dos · android

References

http://source.android.com/security/bulletin/2016-04-02.html
https://android.googlesource.com/platform/frameworks/av/+/1171e7c047bf79e7c93342bb6a812c9edd86aa84
https://www.exploit-db.com/exploits/39685/
http://source.android.com/security/bulletin/2016-04-02.html
https://android.googlesource.com/platform/frameworks/av/+/1171e7c047bf79e7c93342bb6a812c9edd86aa84
https://www.exploit-db.com/exploits/39685/

CWEs

CWE-264

Verify integrity in audit chain (admin only). AS-IS.