CVE-2017-0637: A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially...

Security readout for executives and security teams

CVE-2017-0637 is a critical Android media-processing flaw. A specially crafted media file could corrupt memory in libhevc and may let code run inside the Mediaserver process. Business risk is highest for Android 5.0.2 through 7.1.2 devices without the June 2017 Android security fixes. Exposure is limited to affected Android versions and builds that lack the relevant Android or OEM security update. Organizations should focus on managed mobile fleets, embedded Android devices, kiosks, and legacy handsets that process media from untrusted sources. Treat this as a high-priority legacy Android remediation item. The flaw is critical, but urgency depends on whether affected devices remain in service and whether they process media from untrusted sources. Mitigation focus: Apply the Android June 2017 security bulletin fixes or OEM equivalent updates.; Confirm firmware includes the referenced libhevc security change.; Replace or isolate devices that cannot receive the relevant update..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.