{"id":"CVE-2016-2417","url":"https://www.cyber-defence.io/tools/cve/CVE-2016-2417","generatedAt":"2026-10-27T19:50:01.258Z","title":"media/libmedia/IOMX.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not initialize a parameter data structure, which allows attackers to obtain sensitive information from process…","description":"media/libmedia/IOMX.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not initialize a parameter data structure, which allows attackers to obtain sensitive information from process memory, and consequently bypass an unspecified protection mechanism, via unspecified vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26914474.","published":"2016-04-18T00:59:24.000Z","lastModified":"2026-06-17T00:44:02.000Z","status":"Modified","sourceIdentifier":"security@android.com","cvss":{"version":"3.0","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-264"],"affected":["google/android"],"epss":{"score":0.0532,"percentile":0.92549,"date":"2026-10-26","history":[{"date":"2026-09-21","score":0.04109,"percentile":0.90347},{"date":"2026-09-22","score":0.0532,"percentile":0.92236}]},"kev":{"listed":false},"exploits":{"count":1,"verified":true,"firstPublished":"2016-04-11","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":39685,"kind":"exploit","title":"Google Android - IOMX 'getConfig'/'getParameter' Information Disclosure","url":"https://www.exploit-db.com/exploits/39685","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/android/dos/39685.txt","file":"exploits/android/dos/39685.txt","published":"2016-04-11","added":"2016-04-11","updated":"2016-12-21","author":"Google Security Research","type":"dos","platform":"android","port":null,"verified":true,"codes":["CVE-2016-2417"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://bugs.chromium.org/p/project-zero/issues/detail?id=711"}]},"verdict":{"level":"urgent","text":"A public exploit is published in Exploit-DB (verified) and the impact is critical, while EPSS rates exploitation at 5.3%. Anyone can run this; patch or mitigate before the next change window and check exposed instances for signs of use."},"changes":[],"references":[{"url":"http://source.android.com/security/bulletin/2016-04-02.html","tags":["Vendor Advisory"],"source":"security@android.com"},{"url":"https://android.googlesource.com/platform/frameworks/av/+/1171e7c047bf79e7c93342bb6a812c9edd86aa84","source":"security@android.com"},{"url":"https://www.exploit-db.com/exploits/39685/","source":"security@android.com"},{"url":"http://source.android.com/security/bulletin/2016-04-02.html","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://android.googlesource.com/platform/frameworks/av/+/1171e7c047bf79e7c93342bb6a812c9edd86aa84","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.exploit-db.com/exploits/39685/","source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2016-2417","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}