CVE-2016-2108: Google Android

Critical severity, CVSS 9.8. EPSS: 77.9% chance of exploitation in the next 30 days.

The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the "negative zero" issue.

Affected products

• Google Android: version 4.0 only; version 4.0.1 only; version 4.0.2 only; version 4.0.3 only; version 4.0.4 only; version 4.1 only; …
• OpenSSL OpenSSL: up to and including 1.0.1n; version 1.0.2 only; version 1.0.2a only; version 1.0.2b only
• Red Hat Enterprise Linux Desktop: version 6.0 only; version 7.0 only
• Red Hat Enterprise Linux Hpc Node: version 6.0 only; version 7.0 only
• Red Hat Enterprise Linux Hpc Node Eus: version 7.2 only
• Red Hat Enterprise Linux Server: version 6.0 only; version 7.0 only
• Red Hat Enterprise Linux Server Aus: version 7.2 only
• Red Hat Enterprise Linux Server Eus: version 7.2 only
• Red Hat Enterprise Linux Workstation: version 6.0 only; version 7.0 only

Published 2016-05-05. Last modified 2026-06-17.