A remote code execution vulnerability in libskia in Android 7.0 before 2016-11-01 could enable an attacker using a specially crafted file t…

Published 9 y ago 2016-11-25 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.8

v3.0 · NVD

CISA KEV

not known exploited

EPSS

0.9%

percentile 61%

Public exploits

none known

A remote code execution vulnerability in libskia in Android 7.0 before 2016-11-01 could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as High due to the possibility of remote code execution within the context of the gallery process. Android ID: A-30190637.

Exploit prediction (EPSS)

0.93% probability of exploitation in the next 30 days, higher than 61% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	7.8	`CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`
NVD	2.0	6.8	`AV:N/AC:M/Au:N/C:P/I:P/A:P`

Affected products

Google Inc. Android

Classification

Weakness

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-284 Improper Access Control

References

securityfocus.com /bid/94162 · vdb-entry, x_refsource_BID, x_transferred
source.android.com /security/bulletin/2016-11-01.html · x_refsource_CONFIRM, x_transferred

Sources

CVE List: CVE-2016-6701
NVD: CVE-2016-6701

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.