Stagefright Zero-Click MMS Remote Code Execution in Android libstagefright (CVE-2015-1538)
Joshua Drake of Zimperium zLabs disclosed in July 2015 a set of critical memory-corruption flaws in Android's Stagefright media library — CVE-2015-1538 plus the related CVE-2015-1539, CVE-2015-3824, CVE-2015-3826, CVE-2015-3827, CVE-2015-3828, CVE-2015-3829 and CVE-2015-3864 — that let an attacker run code on an estimated 950 million phones via a single silently received MMS video.
02Deep-Dive Technical Analysis
The bugs resided in the native `libstagefright` C++ engine that parses MP4/3GP metadata. CVE-2015-1538 covers integer overflows in the `stsc`, `ctts`, `stts` and `stss` atom parsers; sibling CVEs cover the `esds` (CVE-2015-1539) and `covr` (CVE-2015-3827) integer underflows and further heap-corruption bugs (CVE-2015-3824, -3826, -3828, -3829, -3864). Because default MMS clients such as Google Hangouts and Messenger automatically fetched and parsed attached video on receipt — before the user opened the message — a crafted MP4 could corrupt the heap and execute code in the privileged mediaserver process with no user interaction. Zimperium released a working proof-of-concept for the CVE-2015-1538 `stsc` overflow in September 2015.
03Vulnerability & Exploit Flow
Integer overflow/underflow in `libstagefright` MP4 atom parsing (e.g. the `stsc` overflow, CVE-2015-1538) triggered automatically when MMS clients pre-process incoming video.
04Recommended Defense & Mitigation Protocol
Disable automatic MMS retrieval in messaging clients, apply the August 2015 and later Android security patches, and sandbox media parser processes.
05Security Impact & Geopolitical Consequence
One of the largest zero-click mobile vulnerabilities ever disclosed, it pushed Google and OEMs such as Samsung to adopt monthly Android security updates and led Google to ship Hangouts and Messenger updates that stopped automatic processing of incoming MMS media.
06Authoritative Standards & External References
07Related Topic Cluster Records
Master 5G Core, SS7 Defense & Subsea Cable Auditing
Ready to turn your historical knowledge into certified hands-on expertise? Register free on TelcoSec Academy to access interactive lab challenges, or consult our enterprise team for carrier-grade signaling assessments and portable BTS hardware.