{"id":"CVE-2015-3864","aliases":["EUVD-2015-3900","GHSA-9pwf-jxj3-pf4m"],"status":"published","title":"Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in...","description":"Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted MPEG-4 data, aka internal bug 23034759.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3824.","severity":{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.87125,"percentile":0.99752,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-189"],"published":"2015-10-01T00:00:00Z","modified":"2026-06-17T00:26:23Z","exploits":[{"source":"exploitdb","id":"EDB-38226","title":"Google Android - libstagefright Integer Overflow Remote Code Execution","type":"remote","platform":"android","date":"2015-09-17","verified":true,"url":"https://www.exploit-db.com/exploits/38226"},{"source":"exploitdb","id":"EDB-39640","title":"Google Android 5.0.1 - Metaphor Stagefright (ASLR Bypass)","type":"remote","platform":"android","date":"2016-03-30","url":"https://www.exploit-db.com/exploits/39640"},{"source":"exploitdb","id":"EDB-40436","title":"Google Android 5.0 \u003c 5.1.1 - 'Stagefright' .MP4 tx3g Integer Overflow (Metasploit)","type":"remote","platform":"android","date":"2016-09-27","verified":true,"url":"https://www.exploit-db.com/exploits/40436"},{"source":"metasploit","id":"exploit/android/browser/stagefright_mp4_tx3g_64bit","title":"Android Stagefright MP4 tx3g Integer Overflow","type":"exploit","platform":"Linux","date":"2015-08-13","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/android/browser/stagefright_mp4_tx3g_64bit"},{"source":"pocgithub","id":"Bhathiya404/Exploiting-Stagefright-Vulnerability-CVE-2015-3864","title":"Bhathiya404/Exploiting-Stagefright-Vulnerability-CVE-2015-3864","date":"2023-02-09","url":"https://github.com/Bhathiya404/Exploiting-Stagefright-Vulnerability-CVE-2015-3864"},{"source":"pocgithub","id":"Cmadhushanka/CVE-2015-3864-Exploitation","title":"Cmadhushanka/CVE-2015-3864-Exploitation","date":"2024-07-10","url":"https://github.com/Cmadhushanka/CVE-2015-3864-Exploitation"},{"source":"pocgithub","id":"HenryVHuang/CVE-2015-3864","title":"HenryVHuang/CVE-2015-3864","date":"2016-09-30","url":"https://github.com/HenryVHuang/CVE-2015-3864"},{"source":"pocgithub","id":"eudemonics/scaredycat","title":"eudemonics/scaredycat","date":"2015-12-08","url":"https://github.com/eudemonics/scaredycat"},{"source":"pocgithub","id":"pwnaccelerator/stagefright-cve-2015-3864","title":"pwnaccelerator/stagefright-cve-2015-3864","date":"2015-08-18","url":"https://github.com/pwnaccelerator/stagefright-cve-2015-3864"}],"products":[{"vendor":"google","product":"android"}],"references":[{"url":"https://groups.google.com/forum/message/raw?msg=android-security-updates/1M7qbSvACjo/Y7jewiW1AwAJ","tags":["mailing-list","x_refsource_MLIST","x_transferred","Vendor Advisory"]},{"url":"https://blog.zimperium.com/cve-2015-3864-metasploit-module-now-available-for-testing/","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory"]},{"url":"https://android.googlesource.com/platform/frameworks/av/+/6fe85f7e15203e48df2cc3e8e1c4bc6ad49dc968","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/38226/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"url":"http://www.securityfocus.com/bid/76682","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://blog.zimperium.com/reflecting-on-stagefright-patches/","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.exploit-db.com/exploits/40436/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"url":"https://www.exploit-db.com/exploits/39640/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3864"},{"url":"https://blog.zimperium.com/cve-2015-3864-metasploit-module-now-available-for-testing"},{"url":"https://blog.zimperium.com/reflecting-on-stagefright-patches"},{"url":"https://www.exploit-db.com/exploits/38226"},{"url":"https://www.exploit-db.com/exploits/39640"},{"url":"https://www.exploit-db.com/exploits/40436"},{"url":"https://github.com/advisories/GHSA-9pwf-jxj3-pf4m"}],"sources":{"cve":[{"id":"CVE-2015-3864","description":"Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted MPEG-4 data, aka internal bug 23034759.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3824.","status":"published","published":"2015-10-01T00:00:00Z","modified":"2024-08-06T05:56:15.946Z","updated_at":"2026-11-02T14:35:42.331636Z"}],"euvd":[{"id":"EUVD-2015-3900","description":"Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted MPEG-4 data, aka internal bug 23034759.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3824.","status":"published","published":"2015-10-01T00:00:00Z","modified":"2024-08-06T05:56:15Z","updated_at":"2026-11-03T02:22:06.212182Z"}],"ghsa":[{"id":"GHSA-9pwf-jxj3-pf4m","title":"Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in...","description":"Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted MPEG-4 data, aka internal bug 23034759.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3824.","status":"published","published":"2022-05-17T01:06:05Z","modified":"2025-04-12T12:53:29Z","updated_at":"2026-11-02T15:01:24.215593Z"}],"nvd":[{"id":"CVE-2015-3864","description":"Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted MPEG-4 data, aka internal bug 23034759.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3824.","status":"published","published":"2015-10-01T00:59:31.56Z","modified":"2026-06-17T00:26:23.7Z","cvss":[{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-189"],"updated_at":"2026-11-02T14:03:09.92183Z"}]}}