Is CVE-2016-2427 actively exploited?

No active exploitation of CVE-2016-2427 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2016-2427 be exploited remotely?

No. CVE-2016-2427 requires local access to exploit.

What is the CVSS score of CVE-2016-2427?

CVE-2016-2427 has a CVSS score of 5.5 (MEDIUM).

HOME VULNERABILITIESCVE-2016-2427

MEDIUM

CVE-2016-2427

CWE-200Published: April 18, 2016· Updated: Jun 17, 2026

5.5

CVSS v3.1

Official Description

The AES-GCM specification in RFC 5084, as used in Android 5.x and 6.x, recommends 12 octets for the aes-ICVlen parameter field, which might make it easier for attackers to defeat a cryptographic protection mechanism and discover an authentication key via a crafted application, aka internal bug 26234568. NOTE: The vendor disputes the existence of this potential issue in Android, stating "This CVE was raised in error: it referred to the authentication tag size in GCM, whose default according to ASN.1 encoding (12 bytes) can lead to vulnerabilities. After careful consideration, it was decided that the insecure default value of 12 bytes was a default only for the encoding and not default anywhere else in Android, and hence no vulnerability existed.

NVD Source

Technical Analysis

CVE-2016-2427 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 5.5.

From a weakness classification perspective (CWE-200): Information exposure vulnerabilities leak sensitive data to unauthorized actors.