CVE-2016-2485
Status: ModifiedHigh (7.8)—
Severity7.8High · CVSS 3.0
Exploitation probability0.42 %higher than 35% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found
libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 does not validate OMX buffer sizes for the GSM and G711 codecs, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27793367.
CVSS
- Base score
- 7.8
- Version
- 3.0
- Vector
- CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days
- 0.42 %
- Percentile among all scored CVEs
- 35
- Score date
- 10/24/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
CWEs
- CWE-119
References
Show 4 references
- http://source.android.com/security/bulletin/2016-06-01.html
- https://android.googlesource.com/platform/frameworks/av/+/7cea5cb64b83d690fe02bc210bbdf08f5a87636f
- http://source.android.com/security/bulletin/2016-06-01.html
- https://android.googlesource.com/platform/frameworks/av/+/7cea5cb64b83d690fe02bc210bbdf08f5a87636f
Raw JSON (NVD)
Show
{
"id": "CVE-2016-2485",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 9.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"authentication": "NONE",
"integrityImpact": "COMPLETE",
"accessComplexity": "MEDIUM",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "security@android.com",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2016-06-13T01:59:24.547",
"references": [
{
"url": "http://source.android.com/security/bulletin/2016-06-01.html",
"tags": [
"Vendor Advisory"
],
"source": "security@android.com"
},
{
"url": "https://android.googlesource.com/platform/frameworks/av/+/7cea5cb64b83d690fe02bc210bbdf08f5a87636f",
"source": "security@android.com"
},
{
"url": "http://source.android.com/security/bulletin/2016-06-01.html",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://android.googlesource.com/platform/frameworks/av/+/7cea5cb64b83d690fe02bc210bbdf08f5a87636f",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-119"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 does not validate OMX buffer sizes for the GSM and G711 codecs, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27793367."
},
{
"lang": "es",
"value": "libstagefright en mediaserver en Android 4.x en versiones anteriores a 4.4.4, 5.0.x en versiones anteriores a 5.0.2, 5.1.x en versiones anteriores a 5.1.1 y 6.x en versiones anteriores a 2016-06-01 no valida tamaños del buffer OMX para los codecs GSM y G711, lo que permite a atacantes obtener privilegios a través de una aplicación manipulada, tal como se demuestra obteniendo acceso a Signature SignatureOrSystem, también conocido como error interno 27793367."
}
],
"lastModified": "2026-06-17T00:44:08.940",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A39C31E3-75C0-4E92-A6B5-7D67B22E3449"
},
{
"criteria": "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BB318EA4-2908-4B91-8DBB-20008FDF528A"
},
{
"criteria": "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1F4E46A9-B652-47CE-92E8-01021E57724B"
},
{
"criteria": "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AB9B53C6-AE84-4A45-B83E-8E5CE44F7B93"
},
{
"criteria": "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "36DD8E3F-6308-4680-B932-4CBD8E58A7FB"
},
{
"criteria": "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1DA9F0F7-D592-481E-884C-B1A94E702825"
},
{
"criteria": "cpe:2.3:o:google:android:4.1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E1BBFD29-6A53-4B1E-9611-680442CD04EB"
},
{
"criteria": "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6CD857E7-B878-49F9-BDDA-93DDEBB0B42B"
},
{
"criteria": "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FBDABB6C-FFF9-4E79-9EF1-BDC0BBDEA9F1"
},
{
"criteria": "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A47AB858-36DE-4330-8CAC-1B46C5C8DA80"
},
{
"criteria": "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "49413FF7-7910-4F74-B106-C3170612CB2A"
},
{
"criteria": "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A2467F65-A3B7-4E45-A9A5-E5A6EFD99D7B"
},
{
"criteria": "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A8882E50-7C49-4A99-91F2-DF979CF8BB2F"
},
{
"criteria": "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7C4E6353-B77A-464F-B7DE-932704003B33"
},
{
"criteria": "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "77125688-2CCA-4990-ABB2-551D47CB0CDD"
},
{
"criteria": "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E7A8EC00-266C-409B-AD43-18E8DFCD6FE3"
},
{
"criteria": "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E70C6D8D-C9C3-4D92-8DFC-71F59E068295"
},
{
"criteria": "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "691FA41B-C2CE-413F-ABB1-0B22CB322807"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "security@android.com"
}