Google Android up to 4.4.3/5.0.1/5.1.0/6.x Mediaserver input validation

Summaryinfo

A vulnerability was found in Google Android up to 4.4.3/5.0.1/5.1.0/6.x. It has been rated as very critical. This affects an unknown function of the component Mediaserver. Performing a manipulation results in input validation. This vulnerability was named CVE-2016-2464. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as very critical, was found in Google Android up to 4.4.3/5.0.1/5.1.0/6.x (Smartphone Operating System). This affects an unknown function of the component Mediaserver. The manipulation with an unknown input leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

libvpx in libwebm in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted mkv file, aka internal bug 23167726.

The weakness was presented 06/13/2016 as 23167726 as confirmed advisory (Website). It is possible to read the advisory at android.googlesource.com. This vulnerability is uniquely identified as CVE-2016-2464 since 02/18/2016. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 08/25/2025). It is expected to see the exploit prices for this product increasing in the near future.

We expect the 0-day to have been worth approximately $100k and more. The vulnerability scanner Nessus provides a plugin with the ID 254363 (Linux Distros Unpatched Vulnerability : CVE-2016-2464), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 4.4.4, 5.0.2, 5.1.1 or 6.0 2016-06-01 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (254363). See VDB-87840, VDB-87841, VDB-87842 and VDB-87844 for similar entries. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Smartphone Operating System

Vendor

• Google

Name

• Android

Version

• 1.0
• 1.1
• 1.5
• 1.6
• 2.0
• 2.0.1
• 2.1
• 2.2
• 2.2.1
• 2.2.2
• 2.2.3
• 2.3
• 2.3.1
• 2.3.2
• 2.3.3
• 2.3.4
• 2.3.5
• 2.3.6
• 2.3.7
• 3.0
• 3.1
• 3.2
• 3.2.1
• 3.2.2
• 3.2.3
• 3.2.4
• 3.2.5
• 3.2.6
• 4.0
• 4.0.1
• 4.0.2
• 4.0.3
• 4.0.4
• 4.1
• 4.1.1
• 4.1.2
• 4.2
• 4.2.1
• 4.2.2
• 4.3
• 4.3.1
• 4.4
• 4.4.1
• 4.4.2
• 4.4.3
• 4.4.4
• 5.0
• 5.0.1
• 5.1.0
• 6.x

License

• free

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion