01 Record

CVE-2015-3864

Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allows remote attackers to execute arbitrary code via

UnratedPUBLISHEDCNA: google_android

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 87.12% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 99.7% of scored records. A rank, not a probability.
NVD base score: The NVD has published no score for this record
NVD CVSS vector: No NVD score to derive
NVD analysis status: Modified. NVD last modified this record on 2026-06-17.
Red Hat severity: No Red Hat rating. Red Hat rates the CVEs that affect its products.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2015-10-01 00:00Z11 YR AGO

Last updated

2024-08-06 05:56Z2 YR AGO

Reserved

2015-05-12

Assigning CNA

google_android

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-189

Data version

5.1

Document digest

1fbc7660df523cfcbb38cfdd210fe8d47ef91c7239de5295ee4a3b16c0529f66

05 Affected products

VendorProductVersionsPlatforms

googleandroidNot specified—

06 References

groups.google.com[android-security-updates] 20150909 Nexus Security Bulletin (September 2015)https://groups.google.com/forum/message/raw?msg=android-security-updates/1M7qbSvACjo/Y7jewiW1AwAJmailing-listx_refsource_MLIST
blog.zimperium.comhttps://blog.zimperium.com/cve-2015-3864-metasploit-module-now-available-for-testing/x_refsource_MISC
android.googlesource.comhttps://android.googlesource.com/platform/frameworks/av/+/6fe85f7e15203e48df2cc3e8e1c4bc6ad49dc968x_refsource_CONFIRM
www.exploit-db.com38226https://www.exploit-db.com/exploits/38226/exploitx_refsource_EXPLOIT-DB
www.securityfocus.com76682http://www.securityfocus.com/bid/76682vdb-entryx_refsource_BID
blog.zimperium.comhttps://blog.zimperium.com/reflecting-on-stagefright-patches/x_refsource_MISC
www.exploit-db.com40436https://www.exploit-db.com/exploits/40436/exploitx_refsource_EXPLOIT-DB
www.exploit-db.com39640https://www.exploit-db.com/exploits/39640/exploitx_refsource_EXPLOIT-DB