‹ Back to list

CVE-2016-6707

Status: ModifiedHigh (7.8)—Exploit
Severity7.8High · CVSS 3.0
Exploitation probability4.15 %higher than 91% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitAvailablePublished on Exploit-DB

An elevation of privilege vulnerability in System Server in Android 6.x before 2016-11-01 and 7.0 before 2016-11-01 could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Android ID: A-31350622.

CVSS

Base score
7.8
Version
3.0
Vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days
4.15 %
Percentile among all scored CVEs
91
Score date
10/20/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Public exploits

Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.

Affected technologies (1)

Google — Android

CWEs

References

Show 10 references

Raw JSON (NVD)

Show
{
  "id": "CVE-2016-6707",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@android.com",
      "affectedData": [
        {
          "vendor": "Google Inc.",
          "product": "Android",
          "versions": [
            {
              "status": "affected",
              "version": "Android-6.0"
            },
            {
              "status": "affected",
              "version": "Android-6.0.1"
            },
            {
              "status": "affected",
              "version": "Android-7.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2016-11-25T16:59:12.500",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/94164",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security@android.com"
    },
    {
      "url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=928",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@android.com"
    },
    {
      "url": "https://googleprojectzero.blogspot.com/2016/12/bitunmap-attacking-android-ashmem.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@android.com"
    },
    {
      "url": "https://source.android.com/security/bulletin/2016-11-01.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@android.com"
    },
    {
      "url": "https://www.exploit-db.com/exploits/40874/",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security@android.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/94164",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=928",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://googleprojectzero.blogspot.com/2016/12/bitunmap-attacking-android-ashmem.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://source.android.com/security/bulletin/2016-11-01.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/40874/",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An elevation of privilege vulnerability in System Server in Android 6.x before 2016-11-01 and 7.0 before 2016-11-01 could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Android ID: A-31350622."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de elevación de privilegio en System Server en Android 6.x en versiones anteriores a 01-11-2016 y 7.0 en versiones anteriores a 01-11-2016 podría habilitar a una aplicación maliciosa local a ejecutar código arbitrario dentro del contexto de un proceso privilegiado. Este problema está clasificado como High porque puede ser usado para obtener acceso local a capacidades elevadas, las cuales no son normalmente accesibles a aplicaciones de terceros. Android ID: A-31350622."
    }
  ],
  "lastModified": "2026-06-17T00:51:37.857",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AAE0DC37-20D9-4AAA-94D9-4E347368D7F1",
              "versionEndIncluding": "6.0.1",
              "versionStartIncluding": "6.0"
            },
            {
              "criteria": "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "09E6085C-A61E-4A89-BF80-EDD9A7DF1E47"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@android.com"
}