CVE-2015-1538

Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in…

Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I allows remote attackers to execute arbitrary code via crafted atoms in MP4 data that trigger an unchecked multiplication, aka internal bug 20139950, a related issue to CVE-2015-4496.

Vendor: google
Product: android
CVSS: No score recorded
CWE: CWE-189
Published: 2015-10-01
NVD modified: 2026-06-17
NVD status: Modified

Not in the CISA KEV catalogue at the last update.

EPSS

99.0% chance of exploitation in the next 30 days (percentile 99th)

FIRST EPSS, updated 17 Oct 2026. About EPSS

CVSS is severity, EPSS is likelihood, KEV means already exploited. EPSS is a statistical probability, not a certainty: a low score does not make a bug safe, and a high one does not prove it is being exploited.

References

packetstormsecurity.com
www.huawei.com
www.securityfocus.com
www.securitytracker.com
www1.huawei.com
android.googlesource.com (Vendor Advisory)
groups.google.com (Vendor Advisory)
www.exploit-db.com
packetstormsecurity.com
www.huawei.com
www.securityfocus.com
www.securitytracker.com

Data last updated 18 Oct 2026. Sources: NVD API 2.0, FIRST EPSS. Links: NVD, CISA KEV. Metadata only. ThreatWire does not host exploit code.