CVE-2015-3864

Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted MPEG-4 data, aka internal bug 23034759. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3824.

• CWE-189

• http://www.securityfocus.com/bid/76682
• https://android.googlesource.com/platform/frameworks/av/+/6fe85f7e15203e48df2cc3e8e1c4bc6ad49dc968Vendor Advisory
• https://blog.zimperium.com/cve-2015-3864-metasploit-module-now-available-for-testing/Release Notes, Third Party Advisory
• https://blog.zimperium.com/reflecting-on-stagefright-patches/
• https://groups.google.com/forum/message/raw?msg=android-security-updates/1M7qbSvACjo/Y7jewiW1AwAJVendor Advisory
• https://www.exploit-db.com/exploits/38226/
• https://www.exploit-db.com/exploits/39640/
• https://www.exploit-db.com/exploits/40436/
• http://www.securityfocus.com/bid/76682
• https://android.googlesource.com/platform/frameworks/av/+/6fe85f7e15203e48df2cc3e8e1c4bc6ad49dc968Vendor Advisory
• https://blog.zimperium.com/cve-2015-3864-metasploit-module-now-available-for-testing/Release Notes, Third Party Advisory
• https://blog.zimperium.com/reflecting-on-stagefright-patches/
• https://groups.google.com/forum/message/raw?msg=android-security-updates/1M7qbSvACjo/Y7jewiW1AwAJVendor Advisory
• https://www.exploit-db.com/exploits/38226/
• https://www.exploit-db.com/exploits/39640/
• https://www.exploit-db.com/exploits/40436/

Published

Oct 1, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-3854packages/SystemUI/src/com/android/systemui/power/PowerNotifi…
• CVE-2015-3858The checkDestination function in internal/telephony/SMSDispa…
• CVE-2015-3860packages/Keyguard/res/layout/keyguard_password_view.xml in L…
• CVE-2015-3861Multiple integer overflows in the addVorbisCodecInfo functio…
• CVE-2015-3862mediaserver in Android before 5.1.1 LMY48T allows attackers …
• CVE-2015-3863Multiple integer overflows in the Blob class in keystore/key…
• CVE-2015-3865The Runtime subsystem in Android before 5.1.1 LMY48T allows …
• CVE-2015-3867libstagefright in Android before 5.1.1 LMY48T allows remote …
• CVE-2015-3868libstagefright in Android before 5.1.1 LMY48T allows remote …
• CVE-2015-3869libstagefright in Android before 5.1.1 LMY48T allows remote …
• CVE-2015-3870libstagefright in Android before 5.1.1 LMY48T allows remote …
• CVE-2015-3871libstagefright in Android before 5.1.1 LMY48T allows remote …