CVE-2016-2061: n/a vulnerability

CVE-2016-2061: Integer signedness error in the MSM V4L2 video driver for the Linux kernel 3.x, as used in Qualcomm Innovat...

Integer signedness error in the MSM V4L2 video driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges or cause a denial of service (array overflow and memory corruption) via a crafted application that triggers an msm_isp_axi_create_stream call.

UnknownCVSS not scoredNot KEV-listedUpdatedAug 5, 2024, 23:17 UTC (UTC+00:00)

Security readout for executives and security teams

This is a kernel-level Android device vulnerability in Qualcomm MSM video driver code. A malicious local app could trigger memory corruption, potentially gaining elevated privileges or crashing the device. The supplied sources do not identify broad product versions beyond MSM devices using the affected QuIC Android kernel contributions. Likely exposure is Android devices or downstream products using Qualcomm MSM kernel 3.x code with the affected MSM V4L2 video driver. The provided CVE data lists affected vendor and product as unavailable, so exact device models must be confirmed through vendor firmware records. Prioritize remediation for managed Android fleets that permit third-party apps or include older Qualcomm MSM devices. Business urgency is higher for unsupported devices, because kernel fixes may only be available through vendor firmware updates. Mitigation focus: Apply relevant Android and device-vendor security updates from June 2016 or later.; Confirm the MSM kernel includes the vendor fix or equivalent backport.; Restrict untrusted app installation on potentially affected Android devices..

Prepared: Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2016-2061 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup

Vulnerability profileCVE Program record

Severity: Unknown
CVSS: Not scored
Known Exploited: No
Published: Jun 13, 2016, 01:00 UTC (UTC+00:00)

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors

0Timeline events

0ADP providers

3Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

CVE List V5 sourceCVE List V5
https://www.codeaurora.org/array-overflow-msm-v4l2-video-driver-allows-kernel-memory-corruption-cve-2016-2061CVE reference · x_refsource_CONFIRM
https://us.codeaurora.org/cgit/quic/la//kernel/msm-3.18/commit/id=79db14ca9f791a14be9376a0340ad3b9b9a4d603CVE reference · x_refsource_CONFIRM

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus

n/an/an/aListed

Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.