Vulnerability Database

317,182

Total vulnerabilities in the database

CVE-2016-3861

LibUtils in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 mishandles conversions between Unicode character encodings with different encoding widths, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted file, aka internal bug 29250543.

  • Published: Sep 11, 2016
  • Updated: Nov 9, 2025
  • CVE: CVE-2016-3861
  • Severity: High
  • Exploit:

CVSS v2:

  • Severity: High
  • Score: 9.3
  • AV:N/AC:M/Au:N/C:C/I:C/A:C

CWEs:

Software From Fixed in
google / android 5.1.0 5.1.0.x
google / android 4.2 4.2.x
google / android 4.1 4.1.x
google / android 6.0.1 6.0.1.x
google / android 6.0 6.0.x
google / android 4.0.2 4.0.2.x
google / android 4.4.3 4.4.3.x
google / android 4.0.4 4.0.4.x
google / android 4.3 4.3.x
google / android 4.0.1 4.0.1.x
google / android 7.0 7.0.x
google / android 4.2.1 4.2.1.x
google / android 5.0.1 5.0.1.x
google / android 5.0 5.0.x
google / android 4.0.3 4.0.3.x
google / android 4.0 4.0.x
google / android 4.4 4.4.x
google / android 4.4.1 4.4.1.x
google / android 4.2.2 4.2.2.x
google / android 4.3.1 4.3.1.x
google / android 4.4.2 4.4.2.x
google / android 5.1 5.1.x
google / android 4.1.2 4.1.2.x