CVE-2016-6773: An information disclosure vulnerability in the ih264d decoder in Mediaserver could enable a local malicious...

Security readout for executives and security teams

This Android vulnerability could let a malicious local app read data it should not be allowed to access. The issue sits in Mediaserver's ih264d video decoder and affects Android 6.0, 6.0.1, and 7.0. Google rated it Moderate because it requires local app execution but may expose sensitive data. Exposure is most likely on legacy Android devices running 6.0, 6.0.1, or 7.0 without the relevant December 2016 Android security bulletin fixes. Modern, supported Android builds are unlikely to be exposed unless vendor patching was missed. Treat this as a legacy-device exposure issue, not an emergency internet-facing vulnerability. Prioritize remediation where Android 6 or 7 devices still access sensitive business data, regulated environments, or unmanaged app sources. Mitigation focus: Identify Android 6.0, 6.0.1, and 7.0 devices in inventory.; Confirm vendor firmware includes the Android December 2016 security bulletin fixes.; Retire or isolate devices that cannot receive vendor security updates..

Prepared

Jun 13, 2026, 12:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.