CVE-2015-1538

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 99.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2015-10-01 · updated 2026-06-17
Weakness: CWE-189

Description

Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I allows remote attackers to execute arbitrary code via crafted atoms in MP4 data that trigger an unchecked multiplication, aka internal bug 20139950, a related issue to CVE-2015-4496.

Affected products

Android: through 5.1

References

http://packetstormsecurity.com/files/134131/Libstagefright-Integer-Overflow-Check-Bypass.html
http://www.huawei.com/en/psirt/security-advisories/hw-448928
http://www.securityfocus.com/bid/76052
http://www.securitytracker.com/id/1033094
http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-448928.htm
https://android.googlesource.com/platform/frameworks/av/+/2434839bbd168469f80dd9a22f1328bc81046398
https://groups.google.com/forum/message/raw?msg=android-security-updates/Ugvu3fi6RQM/yzJvoTVrIQAJ
https://www.exploit-db.com/exploits/38124/
http://packetstormsecurity.com/files/134131/Libstagefright-Integer-Overflow-Check-Bypass.html
http://www.huawei.com/en/psirt/security-advisories/hw-448928
http://www.securityfocus.com/bid/76052
http://www.securitytracker.com/id/1033094

Get alerted when CVE-2015-1538 or the next vulnerability affects your stack