CVE-2015-1538: Android libstagefright integer overflow enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 2.0 score of 10 with remote, unauthenticated code execution and very high EPSS probability, despite no KEV listing.

What it is

An integer overflow in SampleTable::setSampleToChunkParams in libstagefright allows remote attackers to execute arbitrary code by supplying crafted MP4 atoms that trigger an unchecked multiplication. The flaw affects Android before 5.1.1 LMY48I and is remotely reachable, making it a serious risk for unpatched devices.

Impact

A remote attacker can execute arbitrary code in the context of the affected media processing component, potentially gaining control of the device or causing a crash.

Attack surface

The vulnerability is reached over the network via crafted MP4 data, with no authentication or user interaction required per the CVSS vector AV:N/AC:L/Au:N.

Exploitation

The CVE is not listed in CISA KEV, but EPSS indicates a very high probability of exploitation activity (0.99064, 99.931st percentile), and a public exploit exists on Exploit-DB.

What to do

• Apply the Android 5.1.1 LMY48I update or later vendor patch immediately.
• If patching is not possible, restrict or disable automatic processing of untrusted MP4 media on affected devices.
• Use mobile device management to enforce minimum Android patch levels and block vulnerable devices from sensitive networks.
• Monitor vendor advisories for backported fixes from device manufacturers.

Detection

• Monitor for crashes or abnormal behavior in media server processes (e.g., mediaserver) when handling MP4 files.
• Inspect network traffic for MP4 files with malformed or unusually large sample-to-chunk atom values.
• Review device logs for libstagefright-related errors or memory corruption indicators.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.