CVE-2016-5344

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-08-30 · updated 2026-06-17
Weakness: CWE-190

Description

Multiple integer overflows in the MDSS driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allow attackers to cause a denial of service or possibly have unspecified other impact via a large size value, related to mdss_compat_utils.c, mdss_fb.c, and mdss_rotator.c.

Affected products

Android: through 7.0
Linux kernel: from 3.0 through 3.19.8

References

http://source.android.com/security/bulletin/2016-10-01.html
http://www.securityfocus.com/bid/92695
https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=1d2297267c24f2c44bd0ecb244ddb8bc880a29b7
https://www.codeaurora.org/integer-overflow-mdss-driver-cve-2016-5344
http://source.android.com/security/bulletin/2016-10-01.html
http://www.securityfocus.com/bid/92695
https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=1d2297267c24f2c44bd0ecb244ddb8bc880a29b7
https://www.codeaurora.org/integer-overflow-mdss-driver-cve-2016-5344

Get alerted when CVE-2016-5344 or the next vulnerability affects your stack