CVE-2016-2478: mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5...

Security readout for executives and security teams

This Android vulnerability could let a malicious app gain elevated privileges on affected devices. The sources tie it to mediaserver pointer handling in Qualcomm media code and list older Android versions as affected. No active exploitation evidence is provided in the bundle. Exposure is most likely in legacy Android fleets below the fixed version or patch levels. The bundle does not identify specific device models, OEMs, chipsets beyond the Qualcomm media source path, or enterprise apps impacted. Treat this as a legacy-device risk with high impact if affected phones remain in use. Priority should focus on finding unpatched Android devices, confirming vendor patch availability, and retiring devices that cannot be updated. Mitigation focus: Update affected Android devices to the listed fixed versions or later.; Apply the Android 2016-06-01 security patch level or newer where applicable.; Check OEM firmware guidance for devices that no longer receive Android updates..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.