CVE-2017-0538

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A remote code execution vulnerability in libavc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33641588.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

No affected versions have been published.

Timeline

Published
Apr 7, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-05397.8A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory corrCVE-2017-05407.8A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory corrCVE-2017-05417.8A remote code execution vulnerability in sonivox in Mediaserver could enable an attacker using a specially crafted file to cause memory corrCVE-2017-05427.8A remote code execution vulnerability in libavc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruCVE-2017-05437.8A remote code execution vulnerability in libavc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruCVE-2017-05447.8An elevation of privilege vulnerability in CameraBase could enable a local malicious application to execute arbitrary code. This issue is raCVE-2017-05457.8An elevation of privilege vulnerability in Audioserver could enable a local malicious application to execute arbitrary code within the conteCVE-2017-05467.8An elevation of privilege vulnerability in SurfaceFlinger could enable a local malicious application to execute arbitrary code within the coCVE-2017-05475.5An information disclosure vulnerability in libmedia in Mediaserver could enable a local malicious application to access data outside of its CVE-2017-05485.5A remote denial of service vulnerability in libskia could enable an attacker to use a specially crafted file to cause a device hang or rebooCVE-2017-05495.5A remote denial of service vulnerability in libavc in Mediaserver could enable an attacker to use a specially crafted file to cause a deviceCVE-2017-05505.5A remote denial of service vulnerability in libavc in Mediaserver could enable an attacker to use a specially crafted file to cause a device
CVE-2017-0538: High severity, CVSS 7.8 | Vulnix