CVE-2016-5344

Name: CVE-2016-5344
Creator: NVD / NIST
Published: 2016-08-30T17:59:03.503+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

CRITICALCVSS 9.8/10EPSS 1.73%

Last modified Jun 17, 2026

CVE-2016-5344 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Multiple integer overflows in the MDSS driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allow attackers to cause a denial of service or possibly have unspecified other impact via a large size value, related to mdss_compat_utils.c, mdss_fb.c, and mdss_rotator.c.. EPSS estimates a 1.73% chance of exploitation in the next 30 days.

Description

Multiple integer overflows in the MDSS driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allow attackers to cause a denial of service or possibly have unspecified other impact via a large size value, related to mdss_compat_utils.c, mdss_fb.c, and mdss_rotator.c.

Metrics

CVSS 3.1

9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

1.73%

74.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-190

Affected Software

Vendor	Product	Versions
Google	Android	<= 7.0
Linux	Linux Kernel	>= 3.0, <= 3.19.8

References

http://source.android.com/security/bulletin/2016-10-01.htmlPatch, Third Party Advisory
http://www.securityfocus.com/bid/92695Third Party Advisory, VDB Entry
https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=1d2297267c24f2c44bd0ecb244ddb8bc880a29b7Mailing List, Patch, Third Party Advisory
https://www.codeaurora.org/integer-overflow-mdss-driver-cve-2016-5344Broken Link
http://source.android.com/security/bulletin/2016-10-01.htmlPatch, Third Party Advisory
http://www.securityfocus.com/bid/92695Third Party Advisory, VDB Entry
https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=1d2297267c24f2c44bd0ecb244ddb8bc880a29b7Mailing List, Patch, Third Party Advisory
https://www.codeaurora.org/integer-overflow-mdss-driver-cve-2016-5344Broken Link

Timeline

Published: Aug 30, 2016
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2016-5344?

How severe is CVE-2016-5344?

CVE-2016-5344 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 1.73% probability of exploitation in the next 30 days.

How do I fix CVE-2016-5344?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2016-5344?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST