CVE-2015-3828: Android libstagefright 3GPP metadata parsing integer underflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 2.0 score of 10 with remote, unauthenticated code execution and high EPSS probability make this a critical risk for unpatched Android devices.

What it is

MPEG4Extractor::parse3GPPMetaData in Android's libstagefright fails to enforce a minimum size for UTF-16 strings containing a Byte Order Mark, causing an integer underflow and memory corruption. This affects Android before 5.1.1 LMY48I and can be triggered by crafted 3GPP metadata, leading to remote code execution or denial of service.

Impact

An attacker can execute arbitrary code in the context of the media processing service or crash it, potentially gaining control of the device or causing a denial of service.

Attack surface

The flaw is reachable remotely via a crafted 3GPP file or metadata processed by libstagefright, with no authentication required and likely no user interaction beyond opening or previewing the media.

Exploitation

Not listed in CISA KEV, but EPSS probability is 0.85378 (99.7th percentile), indicating high predicted exploitation activity; no public exploit tags are present in the references.

What to do

• Apply the Android 5.1.1 LMY48I or later security update that includes the libstagefright fix.
• Restrict processing of untrusted 3GPP media files on unpatched devices.
• Disable automatic media preview or MMS auto-retrieval where feasible.
• Monitor vendor advisories for backported patches on older Android versions.

Detection

• Monitor for crashes or abnormal behavior in media server processes (e.g., mediaserver, stagefright) when handling 3GPP files.
• Inspect 3GPP metadata for malformed UTF-16 strings with BOM and unusually small sizes.
• Use endpoint detection to flag exploitation attempts targeting libstagefright memory corruption.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.