CVE-2016-2462 — OpenSSLCipher.java in Conscrypt in Android 6.x before 2016-05-01 mishandles updates of the Additional Authenticated Data (AAD) array, which allows attackers to spoof message authentication via unspecified vectors, aka internal bug 27371173

Back Back to CVE browser

HIGH

OpenSSLCipher.java in Conscrypt in Android 6.x before 2016-05-01 mishandles updates of the Additional Authenticated Data (AAD) array, which allows attackers to spoof message authentication via unspecified vectors, aka internal bug 27371173

Published May 9, 2016

7.0

HIGH

CVSS 3.0

EPSS 0.39%

Description

OpenSSLCipher.java in Conscrypt in Android 6.x before 2016-05-01 mishandles updates of the Additional Authenticated Data (AAD) array, which allows attackers to spoof message authentication via unspecified vectors, aka internal bug 27371173.

Affected products

Remediation

No remediation recorded yet.

Metrics

0.39% 0.00391

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00391

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (10 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.39% (0.00391)	30.76th	v5 (v2026.06.15)
Jun 15, 2026	0.39% (0.00391)	30.63th	v5 (v2026.06.15)
Mar 17, 2025	0.06% (0.00064)	17.08th	v4 (v2025.03.14)
Dec 12, 2024	0.05% (0.00054)	24.05th	v3 (v2023.03.01)
Jun 20, 2024	0.05% (0.00054)	22.14th	v3 (v2023.03.01)
Mar 7, 2023	0.05% (0.00054)	20.10th	v3 (v2023.03.01)
Mar 6, 2023	0.89% (0.00885)	27.89th	v2 (v2022.01.01)
Sep 10, 2022	0.89% (0.00885)	26.24th	v2 (v2022.01.01)
Apr 1, 2022	0.89% (0.00885)	24.24th	v2 (v2022.01.01)
Feb 4, 2022	0.89% (0.00885)	10.50th	v2 (v2022.01.01)

Weaknesses (1)

CWE-264

References (2)

http://source.android.com/security/bulletin/2016-05-01.html
x_refsource_CONFIRMPatchVendor Advisory
https://android.googlesource.com/platform/external/conscrypt/+/8bec47d2184fca7e8b7337d2a65b2b75a9bc8f54
x_refsource_CONFIRM

Link	Providers	Tags
http://source.android.com/security/bulletin/2016-05-01.html		x_refsource_CONFIRMPatchVendor Advisory
https://android.googlesource.com/platform/external/conscrypt/+/8bec47d2184fca7e8b7337d2a65b2b75a9bc8f54		x_refsource_CONFIRM

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner google_android

Published May 9, 2016

Updated Aug 5, 2024

Reserved Feb 18, 2016

Link CVE-2016-2462

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2016-2462

Red Hat

Severity n/a

Public date n/a

Links CVE-2016-2462