CVE-2016-1621
libvpx in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.0 before 2016...
libvpx in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.0 before 2016-03-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, related to libwebm/mkvparser.cpp and other files, aka internal bug 23452792.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
libvpx in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.0 before 2016-03-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, related to libwebm/mkvparser.cpp and other files, aka internal bug 23452792.
- Record
CVE-2016-1621- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
libvpx in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.0 before 2016-03-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, related to libwebm/mkvparser.cpp and other files, aka internal bug 23452792.
- Record
CVE-2016-1621- Updated
- 2026-11-02
EUVDEUVD-2016-2716 No score
libvpx in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.0 before 2016-03-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, related to libwebm/mkvparser.cpp and other files, aka internal bug 23452792.
- Record
EUVD-2016-2716- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pjpg-8wjw-xmv3
libvpx in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.0 before 2016...
libvpx in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.0 before 2016-03-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, related to libwebm/mkvparser.cpp and other files, aka internal bug 23452792.
- Record
GHSA-pjpg-8wjw-xmv3- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
OSV
libvpx in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.0 before 2016-03-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, related to libwebm/mkvparser.cpp and other files, aka internal bug 23452792.
- Record
CVE-2016-1621- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-1621
libvpx in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.0 before 2016-03-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, related to libwebm/mkvparser.cpp and other files, aka internal bug 23452792.
- Record
DEBIAN-CVE-2016-1621- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-1621
libvpx in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.0 before 2016-03-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, related to libwebm/mkvparser.cpp and other files, aka internal bug 23452792.
- Record
UBUNTU-CVE-2016-1621- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10422-1 No score
libvpx-devel-1.6.0-2.1 on GA media
These are all security issues fixed in the libvpx-devel-1.6.0-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10422-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libvpxDebian:12 |
before 1.6.1-1 | 1.6.1-1 |
libvpxDebian:13 |
before 1.6.1-1 | 1.6.1-1 |
libvpxDebian:14 |
before 1.6.1-1 | 1.6.1-1 |
androidUbuntu:16.04:LTS |
before 20160307-0742-0ubuntu3, plus listed versions 20150818-1500-0ubuntu220150818-1500-0ubuntu3 |
20160307-0742-0ubuntu3 |
libvpxopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 1.6.0-2.1 | 1.6.0-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-1621 is a critical vulnerability (CVSS 9.8) in Google Android, published March 12, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.90%, the 93rd percentile. Fixed in libvpx 1.6.1-1.
References
android.googlesource.com/platform/external/libvpx/+/04839626ed859623901ebd3a5fd483982186b59d
source.android.com/security/bulletin/2016-03-01.html
security.gentoo.org/glsa/201603-09
securityfocus.com/bid/84239
Show 8 moreShow less
lists.fedoraproject.org/pipermail/package-announce/2016-March/179128.html
nvd.nist.gov/vuln/detail/CVE-2016-1621
github.com/advisories/GHSA-pjpg-8wjw-xmv3
security-tracker.debian.org/tracker/CVE-2016-1621
ubuntu.com/security/CVE-2016-1621
cve.org/CVERecord?id=CVE-2016-1621
suse.com/security/cve/CVE-2016-1621