CVE-2016-2418
CRITICALAndroid 6.x - Information Disclosure via Uninitialized Metadata Buffer Pointers
Title source: llmDescription
media/libmedia/IOMX.cpp in mediaserver in Android 6.x before 2016-04-01 does not initialize certain metadata buffer pointers, which allows attackers to obtain sensitive information from process memory, and consequently bypass an unspecified protection mechanism, via unspecified vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26324358.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_confirm
https://android.googlesource.com/platform/frameworks/av/+/8d87321b704cb3f88e8cae668937d001fd63d5e3
Vendor Advisory x_refsource_confirm
http://source.android.com/security/bulletin/2016-04-02.html
Scores
CVSS v3
9.8
EPSS
0.0080
EPSS Percentile
52.2%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-119
Status
published
Products (2)
google/android
6.0
google/android
6.0.1
Published
Apr 18, 2016
Tracked Since
Feb 18, 2026