CVE-2015-3826: Android libstagefright 3GPP metadata parsing integer underflow crash

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

medium priorityThe flaw is remotely reachable without authentication but the described impact is limited to denial of service, and no confirmed exploit is documented in the record.

What it is

MPEG4Extractor::parse3GPPMetaData in Android's libstagefright fails to enforce a minimum size for UTF-16 strings containing a Byte Order Mark, causing an integer underflow and buffer over-read. A crafted 3GPP metadata file can crash the mediaserver process, disrupting media playback and related services on affected devices.

Impact

An attacker gains a denial of service: the mediaserver process crashes, interrupting media and related system services. The record describes no code execution or data disclosure, only a crash.

Attack surface

Reached remotely over the network with no authentication and no user interaction beyond processing the crafted 3GPP metadata, per the AV:N/AC:L/Au:N vector. The flaw sits in media file parsing, so any path that feeds attacker-supplied 3GPP metadata to libstagefright is exposed.

Exploitation

Not listed in CISA KEV and no reference is tagged as exploit code, though EPSS is high at 0.73566 (99.4th percentile), indicating elevated predicted exploitation likelihood. No public exploit is confirmed by the supplied data.

What to do

• Apply the Android 5.1.1 LMY48I or later update containing the libstagefright fix referenced in the vendor advisory.
• Restrict or block untrusted 3GPP media from reaching media parsing services where feasible.
• Track vendor security bulletins for affected Android builds and confirm patch status on managed devices.
• Monitor mediaserver crashes as an indicator of attempted exploitation.

Detection

• Alert on repeated mediaserver process crashes or restarts on Android endpoints.
• Inspect 3GPP metadata for malformed UTF-16 BOM strings during media file scanning.
• Correlate crash telemetry with receipt of externally sourced 3GPP files.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.