CVE-2017-0760: A remote code execution vulnerability in the Android media framework (libstagefright).

Security readout for executives and security teams

CVE-2017-0760 is a remote code execution issue in Android's media framework, libstagefright. The source bundle identifies Android 6.0 through 7.1.2 as affected. Business risk is highest for organizations still operating legacy or unmanaged Android devices without vendor firmware containing the September 2017 Android security bulletin fixes. Exposure is most likely on older Android phones, tablets, embedded devices, or BYOD assets running affected Android versions without the relevant vendor security update. Modern managed devices with post-2017 security updates are less likely to be exposed, but firmware patch evidence should be verified. Prioritize remediation if legacy Android devices still access corporate systems. The issue is old, but unsupported mobile devices often remain in operational environments. Treat unpatched affected devices as avoidable exposure and remove them from sensitive workflows where patching cannot be confirmed. Mitigation focus: Identify Android devices running versions 6.0 through 7.1.2.; Apply vendor firmware containing the Android 2017-09-01 security bulletin fixes.; Retire or isolate affected devices that cannot receive vendor updates..

Prepared

Jun 12, 2026, 21:19 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.