Return to libstagefright: exploiting libutils on Android

Summary: Project Zero's Mark Brand disclosed CVE-2016-3861, a bug in libutils' UTF16-to-UTF8 conversion where utf16_to_utf8_length and utf16_to_utf8 disagree on output size, allowing a heap overflow of a controlled size in multiples of 4 bytes. The flaw is reachable from many attack vectors, including Parcel.cpp code called by every system service and ID3 tag parsing in mediaserver, and can be used for remote code execution and local privilege elevation into the system_server SELinux domain.
What you should know: A single conversion routine used across Android's system services and media parsing gave attackers both a remote code execution path and a route into system_server, the most privileged userland domain on the device.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026