Stagefrightened?
Summary: Project Zero's Mark Brand published a working exploit for CVE-2015-3864, a libstagefright flaw in Android's handling of 'tx3g' chunks in MPEG4 files, demonstrating it on Android 5.0+ on a Nexus 5. The September patch checked chunk_size against SIZE_MAX but chunk_size is a uint64_t even on 32-bit platforms, so a value larger than SIZE_MAX passes the check and triggers a linear heap overflow. The exploit grooms the heap with 'pssh', 'avcC' and 'hvcC' chunks to place a 32-byte MPEG4DataSource object after the overflowed buffer, then corrupts its vtable to gain control of execution.
What you should know: The bug is an incomplete patch for an issue Joshua Drake reported, fixed for Nexus devices in the September bulletin - a reminder that a shipped fix can still leave the underlying flaw reachable. The exploit targets mediaserver, a 32-bit process even on 64-bit Android devices, and is reached by parsing a crafted MPEG4 file.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2015-3864
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026