CVE-2016-0838

Published: Apr 18, 2016Modified: May 6, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Sonivox in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not check for a negative number of samples, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, related to arm-wt-22k/lib_src/eas_wtengine.c and arm-wt-22k/lib_src/eas_wtsynth.c, aka internal bug 26366256.

Affected (22)

Products: Google: Android

Google

1 product

Android

Configuration A

22 vulnerable

Vulnerable Software	Affected Versions
Google Android	Version 4.0.1
Google Android	Version 4.0.2
Google Android	Version 4.0.3
Google Android	Version 4.0.4
Google Android	Version 4.0
Google Android	Version 4.1.2
Google Android	Version 4.1
Google Android	Version 4.2.1
Google Android	Version 4.2.2
Google Android	Version 4.2
Google Android	Version 4.3.1
Google Android	Version 4.3
Google Android	Version 4.4.1
Google Android	Version 4.4.2
Google Android	Version 4.4.3
Google Android	Version 4.4
Google Android	Version 5.0.1
Google Android	Version 5.0
Google Android	Version 5.1.0
Google Android	Version 5.1
Google Android	Version 6.0.1
Google Android	Version 6.0