‹ Back to list

CVE-2015-3864

Status: ModifiedHigh (10)—Exploit
Severity10High · CVSS 2.0
Exploitation probability87 %higher than 100% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitAvailablePublished on Exploit-DB · Proof of concept on GitHub (unverified) · Metasploit module (reliable, widely available exploit)

Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted MPEG-4 data, aka internal bug 23034759. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3824.

CVSS

Base score
10
Version
2.0
Vector
AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days
87 %
Percentile among all scored CVEs
100
Score date
10/17/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Public exploits

Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.

⚠️ GitHub proofs of concept are not verified: some are fake or contain malware. Never run them outside an isolated lab.

Affected technologies (1)

Google — Android

CWEs

References

Show 16 references

Raw JSON (NVD)

Show
{
  "id": "CVE-2015-3864",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "security@android.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-10-01T00:59:31.560",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/76682",
      "source": "security@android.com"
    },
    {
      "url": "https://android.googlesource.com/platform/frameworks/av/+/6fe85f7e15203e48df2cc3e8e1c4bc6ad49dc968",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@android.com"
    },
    {
      "url": "https://blog.zimperium.com/cve-2015-3864-metasploit-module-now-available-for-testing/",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "security@android.com"
    },
    {
      "url": "https://blog.zimperium.com/reflecting-on-stagefright-patches/",
      "source": "security@android.com"
    },
    {
      "url": "https://groups.google.com/forum/message/raw?msg=android-security-updates/1M7qbSvACjo/Y7jewiW1AwAJ",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@android.com"
    },
    {
      "url": "https://www.exploit-db.com/exploits/38226/",
      "source": "security@android.com"
    },
    {
      "url": "https://www.exploit-db.com/exploits/39640/",
      "source": "security@android.com"
    },
    {
      "url": "https://www.exploit-db.com/exploits/40436/",
      "source": "security@android.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/76682",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://android.googlesource.com/platform/frameworks/av/+/6fe85f7e15203e48df2cc3e8e1c4bc6ad49dc968",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://blog.zimperium.com/cve-2015-3864-metasploit-module-now-available-for-testing/",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://blog.zimperium.com/reflecting-on-stagefright-patches/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://groups.google.com/forum/message/raw?msg=android-security-updates/1M7qbSvACjo/Y7jewiW1AwAJ",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/38226/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/39640/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/40436/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-189"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted MPEG-4 data, aka internal bug 23034759.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3824."
    },
    {
      "lang": "es",
      "value": "Desbordamiento de entero inferior en la función MPEG4Extractor::parseChunk en MPEG4Extractor.cpp en libstagefright en mediaserver en Android en versiones anteriores a 5.1.1 LMY48M permite a atacantes remotos ejecutar código arbitrario a través de datos MPEG-4 manipulados, también conocido como error interno 23034759. NOTA: esta vulnerabilidad existe debido a una solución incompleta para la CVE-2015-3824."
    }
  ],
  "lastModified": "2026-06-17T00:26:23.700",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3573E693-716C-4B92-AC87-6466CBC26527",
              "versionEndIncluding": "5.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@android.com"
}