CVE-2016-3751: Google Android

High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days.

Unspecified vulnerability in libpng before 1.6.20, as used in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01, allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 23265085.

Affected products

• Google Android: version 4.0 only; version 4.0.1 only; version 4.0.2 only; version 4.0.3 only; version 4.0.4 only; version 4.1 only; …
• Libpng Libpng: up to and including 1.6.19

Published 2016-07-11. Last modified 2026-06-17.