CVE-2016-3934 Memory corruption in n/a

High 7.8 Published 10 Oct 2016 Updated 6 Aug 2024

A crafted application can exploit variable-length arrays in the Qualcomm camera driver to gain elevated privileges on Android devices.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2016-3934?

CVE-2016-3934 is a high-severity memory corruption vulnerability in Google Android, published on 10 Oct 2016. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_cci_i2c.c in the Qualcomm camera driver in Android before 2016-10-05 on Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, and Android One devices relies on variable-length arrays, which allows attackers to gain privileges via a crafted application, aka Android internal bug 30102557 and Qualcomm internal bug CR 789704.

Weakness: CWE-119

Which versions are affected by CVE-2016-3934?

It affects 1 product.

Products include Google Android.

How do I fix CVE-2016-3934?

No fix has been published for CVE-2016-3934 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2016-3934 being exploited?

There is no known exploitation of CVE-2016-3934 in the wild and no public exploit code.

All Google Android vulnerabilities

Sources

Also known as GHSA-pjgw-wg5j-h435.