---
id: 8730
title: "[CVE-2016-3861] Return to libstagefright: exploiting libutils on Android"
cve: CVE-2016-3861
source_domain: projectzero.google
source_url: "https://projectzero.google/2016/09/return-to-libstagefright-exploiting.html"
published_at: "2016-09-07T00:00:00Z"
tags: ["rce", "fuzzing", "privilege-escalation", "android", "cve-2016-3861", "libstagefright"]
phying_url: "https://phying.com/item/8730"
lang: en
---

# [CVE-2016-3861] Return to libstagefright: exploiting libutils on Android

## Summary

Fuzzing Android devices uncovered CVE-2016-3861 in libutils, a severe bug reachable from many attack vectors and usable for remote code execution and elevation into the system_server SELinux domain.

## Intelligence Metadata

- **Sources:** projectzero.google
- **CVE:** CVE-2016-3861
- **Published:** 2016-09-07T00:00:00Z
- **Original:** https://projectzero.google/2016/09/return-to-libstagefright-exploiting.html
- **Phying News:** https://phying.com/item/8730