VULNERABILITY INTELLIGENCE
CVE-2015-6602
CVSS score9.3 HIGH
EPSS probability3.36%
CISA KEVNot currently listed
Published2015-10-02
Last modified2026-06-17
CVSS vectorAV:N/AC:M/Au:N/C:C/I:C/A:C
Description
libutils in Android through 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted metadata in a (1) MP3 or (2) MP4 file, as demonstrated by an attack against use of libutils by libstagefright in Android 5.x.
Weakness classification
- CWE-20: Improper Input Validation