Vulnerability record · CVE-2015-3829 · published 1 October 2015
CVE-2015-3829: Android libstagefright MPEG4Extractor off-by-one memory corruption
Google · Android
An off-by-one error in MPEG4Extractor::parseChunk in libstagefright on Android before 5.1.1 LMY48I mishandles crafted MPEG-4 covr atoms whose size equals SIZE_MAX, causing an integer overflow and memory corruption. Because libstagefright processes media automatically, this flaw matters for any Android device that parses attacker-supplied MPEG-4 content.
Description
Off-by-one error in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow and memory corruption) via crafted MPEG-4 covr atoms with a size equal to SIZE_MAX, aka internal bug 20923261.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
critical priorityCVSS 2.0 score of 10 with full confidentiality, integrity and availability impact, remote unauthenticated reachability, and a very high EPSS probability make this a top-priority fix.
What it is
An off-by-one error in MPEG4Extractor::parseChunk in libstagefright on Android before 5.1.1 LMY48I mishandles crafted MPEG-4 covr atoms whose size equals SIZE_MAX, causing an integer overflow and memory corruption. Because libstagefright processes media automatically, this flaw matters for any Android device that parses attacker-supplied MPEG-4 content.
Impact
A remote attacker can execute arbitrary code in the context of the media processing service or crash it, causing denial of service. Successful code execution would give the attacker the privileges of that process on the device.
Attack surface
Reachable remotely over the network with no authentication and no user interaction beyond the device processing the crafted MPEG-4 file, per the AV:N/AC:L/Au:N vector. The description does not specify the exact delivery channel, but media parsing is the entry point.
Exploitation
Not listed in CISA KEV and no reference is tagged as exploit code, but EPSS is very high at 0.89782 (99.78th percentile), indicating strong predicted exploitation activity.
What to do
- Upgrade Android to 5.1.1 LMY48I or later, or apply the vendor patch referenced in the Android source commit.
- If immediate upgrade is not possible, restrict or disable automatic processing of untrusted MPEG-4 media where the platform allows it.
- Apply the corresponding Huawei advisory fixes on affected Huawei devices.
- Track device vendor security bulletins for backported libstagefright fixes on older Android branches.
Detection
- Monitor for crashes or abnormal terminations in mediaserver, stagefright, or related media processes.
- Inspect MPEG-4 files for covr atoms with a declared size of SIZE_MAX or otherwise malformed atom lengths.
- Alert on unexpected child processes or outbound connections originating from media parsing services.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2015-3829 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2015-3829), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
