CVE-2015-3827
The MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before...
The MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not validate the relationship between chunk sizes and skip sizes, which allows remote attackers to execute arbitrary code or cause a denial of service (integer underflow and memory corruption) via crafted MPEG-4 covr atoms, aka internal bug 20923261.
Exploit likelihood
What each source reports
NVD Score used
The MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not validate the relationship between chunk sizes and skip sizes, which allows remote attackers to execute arbitrary code or cause a denial of service (integer underflow and memory corruption) via crafted MPEG-4 covr atoms, aka internal bug 20923261.
- Record
CVE-2015-3827- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-119, CWE-189
- Updated
- 2026-11-02
CVE List No score
The MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not validate the relationship between chunk sizes and skip sizes, which allows remote attackers to execute arbitrary code or cause a denial of service (integer underflow and memory corruption) via crafted MPEG-4 covr atoms, aka internal bug 20923261.
- Record
CVE-2015-3827- Updated
- 2026-11-02
EUVDEUVD-2015-3863 No score
The MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not validate the relationship between chunk sizes and skip sizes, which allows remote attackers to execute arbitrary code or cause a denial of service (integer underflow and memory corruption) via crafted MPEG-4 covr atoms, aka internal bug 20923261.
- Record
EUVD-2015-3863- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7fgg-vfmh-488w No score
The MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before...
The MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not validate the relationship between chunk sizes and skip sizes, which allows remote attackers to execute arbitrary code or cause a denial of service (integer underflow and memory corruption) via crafted MPEG-4 covr atoms, aka internal bug 20923261.
- Record
GHSA-7fgg-vfmh-488w- Weakness
- CWE-119
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-3827 is a high vulnerability (CVSS 9.3) in Google Android, published October 1, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 81.1%, the 99th percentile. No source names a fixed version.
References
securitytracker.com/id/1033094
securityfocus.com/bid/76052
www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-448928.htm
huawei.com/en/psirt/security-advisories/hw-448928
android.googlesource.com/platform/frameworks/av/+/f4a88c8ed4f8186b3d6e2852993e063fc33ff231
groups.google.com/forum/message/raw?msg=android-security-updates/Ugvu3fi6RQM/yzJvoTVrIQAJ
nvd.nist.gov/vuln/detail/CVE-2015-3827
github.com/advisories/GHSA-7fgg-vfmh-488w