CVE-2015-3824: Android libstagefright MPEG4Extractor integer overflow in tx3g atom parsing

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 2.0 base score of 10 with network reachability, no authentication and full code execution impact, combined with a 99.8th percentile EPSS probability, makes this a top-priority patching target despite no KEV listing.

What it is

The MPEG4Extractor::parseChunk function in Android's libstagefright fails to properly restrict size addition when parsing a crafted MPEG-4 tx3g atom, causing an integer overflow and memory corruption. Because media parsing is reachable from untrusted files and streams, this is a serious remote code execution and denial of service flaw in affected Android versions before 5.1.1 LMY48I.

Impact

An attacker can execute arbitrary code in the context of the media parsing process or crash it, leading to full compromise of confidentiality, integrity and availability per the CVSS 2.0 vector.

Attack surface

Reached remotely over the network with no authentication and no user interaction beyond processing the crafted MPEG-4 content, as reflected in the AV:N/AC:L/Au:N vector; the malicious tx3g atom can be delivered via a file, MMS or streamed media.

Exploitation

Not listed in CISA KEV and no exploit tags appear in the references, but EPSS is very high at 0.90483 (99.8th percentile), indicating strong likelihood of exploitation activity.

What to do

• Upgrade Android to 5.1.1 LMY48I or later, which contains the fix referenced in the Android source commit.
• Apply the vendor security update from the Android security bulletin and any OEM (e.g. Huawei) advisories covering this bug.
• Where immediate patching is not possible, restrict or disable automatic processing of untrusted MPEG-4 media and MMS attachments on affected devices.
• Monitor and retire end-of-life Android devices that cannot receive the 5.1.1 LMY48I or later build.

Detection

• Hunt for crashes or memory corruption events in mediaserver/stagefright processes when handling MPEG-4 files.
• Inspect MPEG-4 files for malformed or oversized tx3g atoms that could trigger the integer overflow.
• Correlate device logs and crash reports referencing MPEG4Extractor or libstagefright with receipt of external media.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.