CVE-2016-2459
Status: ModifiedMedium (5.5)—
Severity5.5Medium · CVSS 3.0
Exploitation probability0.41 %higher than 35% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found
mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not initialize certain data structures, which allows attackers to obtain sensitive information via a crafted application, related to IGraphicBufferConsumer.cpp and IGraphicBufferProducer.cpp, aka internal bug 27556038.
CVSS
- Base score
- 5.5
- Version
- 3.0
- Vector
- CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days
- 0.41 %
- Percentile among all scored CVEs
- 35
- Score date
- 10/24/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
CWEs
- CWE-200
References
Show 4 references
- http://source.android.com/security/bulletin/2016-05-01.html
- https://android.googlesource.com/platform/frameworks/native/+/a30d7d90c4f718e46fb41a99b3d52800e1011b73
- http://source.android.com/security/bulletin/2016-05-01.html
- https://android.googlesource.com/platform/frameworks/native/+/a30d7d90c4f718e46fb41a99b3d52800e1011b73
Raw JSON (NVD)
Show
{
"id": "CVE-2016-2459",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"authentication": "NONE",
"integrityImpact": "NONE",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 5.5,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 3.6,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "security@android.com",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2016-05-09T10:59:37.297",
"references": [
{
"url": "http://source.android.com/security/bulletin/2016-05-01.html",
"tags": [
"Vendor Advisory"
],
"source": "security@android.com"
},
{
"url": "https://android.googlesource.com/platform/frameworks/native/+/a30d7d90c4f718e46fb41a99b3d52800e1011b73",
"source": "security@android.com"
},
{
"url": "http://source.android.com/security/bulletin/2016-05-01.html",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://android.googlesource.com/platform/frameworks/native/+/a30d7d90c4f718e46fb41a99b3d52800e1011b73",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-200"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not initialize certain data structures, which allows attackers to obtain sensitive information via a crafted application, related to IGraphicBufferConsumer.cpp and IGraphicBufferProducer.cpp, aka internal bug 27556038."
},
{
"lang": "es",
"value": "mediaserver en Android 4.x en versiones anteriores a 4.4.4, 5.0.x en versiones anteriores a 5.0.2, 5.1.x en versiones anteriores a 5.1.1 y 6.x en versiones anteriores a 2016-05-01 no inicializa determinadas estructuras de datos, lo que permite a atacantes obtener información sensible a través de una aplicación manipulada, relacionado con IGraphicBufferConsumer.cpp y IGraphicBufferProducer.cpp, también conocido como error interno 27556038."
}
],
"lastModified": "2026-06-17T00:44:06.187",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A39C31E3-75C0-4E92-A6B5-7D67B22E3449"
},
{
"criteria": "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BB318EA4-2908-4B91-8DBB-20008FDF528A"
},
{
"criteria": "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1F4E46A9-B652-47CE-92E8-01021E57724B"
},
{
"criteria": "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AB9B53C6-AE84-4A45-B83E-8E5CE44F7B93"
},
{
"criteria": "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "36DD8E3F-6308-4680-B932-4CBD8E58A7FB"
},
{
"criteria": "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1DA9F0F7-D592-481E-884C-B1A94E702825"
},
{
"criteria": "cpe:2.3:o:google:android:4.1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E1BBFD29-6A53-4B1E-9611-680442CD04EB"
},
{
"criteria": "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6CD857E7-B878-49F9-BDDA-93DDEBB0B42B"
},
{
"criteria": "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FBDABB6C-FFF9-4E79-9EF1-BDC0BBDEA9F1"
},
{
"criteria": "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A47AB858-36DE-4330-8CAC-1B46C5C8DA80"
},
{
"criteria": "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "49413FF7-7910-4F74-B106-C3170612CB2A"
},
{
"criteria": "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A2467F65-A3B7-4E45-A9A5-E5A6EFD99D7B"
},
{
"criteria": "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A8882E50-7C49-4A99-91F2-DF979CF8BB2F"
},
{
"criteria": "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "98C32982-095C-4628-9958-118A3D3A9CAA"
},
{
"criteria": "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8FC0FCEA-0B3D-43C1-AB62-4F9C880B4CA1"
},
{
"criteria": "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EC75ED04-B8C7-4CC0-AC64-AE2D9E0CDF5D"
},
{
"criteria": "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FC13D3EE-CC89-4883-8E3D-3FE25FB8CF42"
},
{
"criteria": "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7C4E6353-B77A-464F-B7DE-932704003B33"
},
{
"criteria": "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "77125688-2CCA-4990-ABB2-551D47CB0CDD"
},
{
"criteria": "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E7A8EC00-266C-409B-AD43-18E8DFCD6FE3"
},
{
"criteria": "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E70C6D8D-C9C3-4D92-8DFC-71F59E068295"
},
{
"criteria": "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "691FA41B-C2CE-413F-ABB1-0B22CB322807"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:google:android_one:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "50A96E21-4545-41AD-9FDB-E6F2B59F2DEF"
},
{
"criteria": "cpe:2.3:h:google:nexus_5:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "25DB8689-116F-49B5-91F5-BCBA8854BD42"
},
{
"criteria": "cpe:2.3:h:google:nexus_5x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "881D2748-D79A-491F-97AA-BB83BBDFD348"
},
{
"criteria": "cpe:2.3:h:google:nexus_6:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "065B6512-4BB7-4A7D-B5C8-61E27B07D588"
},
{
"criteria": "cpe:2.3:h:google:nexus_6p:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "A988DE0D-BFF2-453E-B502-A53F7976145A"
},
{
"criteria": "cpe:2.3:h:google:nexus_7_\\(2013\\):-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "8C58736F-CD29-489E-95AF-4066E688705D"
},
{
"criteria": "cpe:2.3:h:google:nexus_9:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "1018566D-5DBE-44BD-BA05-1F6A6375C32F"
},
{
"criteria": "cpe:2.3:h:google:nexus_player:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "C28515A5-7911-40B0-971D-9F593142170E"
},
{
"criteria": "cpe:2.3:h:google:pixel_c:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "9526852E-8BF4-42AA-A9BC-84FEC564B871"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "security@android.com"
}