CVE-2015-3827: Android libstagefright MPEG4Extractor chunk size validation flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote code execution with no authentication and high EPSS probability, though exploitation requires user interaction and the affected Android versions are old.

What it is

MPEG4Extractor::parseChunk in Android's libstagefright fails to validate the relationship between chunk sizes and skip sizes when parsing MPEG-4 covr atoms. This allows crafted media files to trigger an integer underflow and memory corruption. The flaw affects Android before 5.1.1 LMY48I and is remotely reachable through media processing.

Impact

An attacker can execute arbitrary code in the context of the media processing service or cause a denial of service through memory corruption. Successful code execution could give the attacker the privileges of the affected process.

Attack surface

The vulnerability is reached remotely by supplying a crafted MPEG-4 file containing malicious covr atoms, typically via MMS, web browsing, or any app that parses media. No authentication is required, but some user interaction (opening or previewing the file) is needed per the AV:N/AC:M vector.

Exploitation

CVE-2015-3827 is not listed in CISA KEV, but EPSS shows a 30-day probability of 0.81143 (99.6th percentile), indicating high predicted exploitation likelihood. References include vendor advisories from Google and Huawei but no public exploit tags.

What to do

• Apply the Android 5.1.1 LMY48I or later security update that includes the libstagefright fix.
• Restrict or disable automatic MMS media preview and auto-download of media attachments on affected devices.
• Avoid opening untrusted MPEG-4 files from unknown sources until devices are patched.
• Monitor vendor advisories for backported fixes on OEM builds that may lag the AOSP patch.

Detection

• Monitor for crashes or abnormal terminations in media server or stagefright-related processes when processing MPEG-4 files.
• Inspect MPEG-4 files for malformed covr atoms with inconsistent chunk and skip sizes using a parser or file analysis tool.
• Correlate device logs showing libstagefright parse errors with receipt of media via MMS or browser downloads.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.