CVE-2025-54255

Adobe Acrobat Reader is affected by CVE-2025-54255 (Violation of Secure Design Principles) in versions 24.001.30254, 20.005.30774, 25.001.20672 and earlier. The issue could bypass an integrity-related security feature and does not require authentication or user interaction; the impact is limited ...

CVE-2025-26440

In multiple functions of CameraService.cpp, there is a possible way to use the camera from the background due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-26455

In multiple functions of NdkMediaCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48541

In onCreate of FaceSettings.java, there is a possible way to remove biometric unlock across user profiles due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48581

CVE-2025-48581 corresponds to a logic error in the Android system component apexd.cpp, within the VerifyNoOverlapInSessions function, that can block security updates. The impact is local privilege escalation with no additional execution privileges required and no user interaction needed for explo...

CVE-2025-48558

In multiple functions of BatteryService.java, there is a possible way to hijack implicit intent intended for system app due to Implicit intent hijacking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitatio...

CVE-2025-48537

CVE-2025-48537 affects Google Android and is described as a locally exploitable DoS due to improper input validation in multiple locations, which can also lead to local information disclosure without additional privileges or user interaction. Android security bulletins associate this and related ...

CVE-2025-48533

In multiple locations, there is a possible way to use apps linked from a context menu of a lockscreen app due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-32312

In createIntentsList of PackageParser.java , there is a possible way to bypass lazy bundle hardening, allowing modified data to be passed to the next process due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User...

CVE-2025-26449

In multiple locations, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-32312

CVE-2025-32312 affects Android’s PackageParser.java, specifically the function createIntentsList. Root cause: unsafe deserialization that bypasses lazy bundle hardening, allowing modified data to flow to the next process. Impact: local privilege escalation with no additional privileges required; ...

CVE-2025-26456

CVE-2025-26456 affects DexUseManagerLocal.java in Android; a logic error can crash the system server, leading to local, permanent denial of service without extra privileges or user interaction. Exploitation / patch details are not provided in the supplied documents; no explicit remediation versio...

CVE-2025-36894

CVE-2025-36894 is a DoS issue affecting Google Pixel devices, categorized under the Modem component in the Pixel update bulletin. The vulnerability stems from a missing null check, enabling remote denial of service without additional privileges or user interaction. The Android Pixel bulletin assi...

PT-2025-35882

Name of the Vulnerable Software and Affected Versions: affected versions not specified Description: A possible escalation of privilege exists due to test/debugging code remaining in a production build. This could lead to physical escalation of privilege without requiring additional execution...

PT-2025-36034

Name of the Vulnerable Software and Affected Versions: AccountTypePreferenceLoader.java affected versions not specified Description: The isSafeIntent function in AccountTypePreferenceLoader.java may allow bypassing an intent type check due to a confused deputy condition. This could lead to local...

PT-2025-36013

Name of the Vulnerable Software and Affected Versions: affected versions not specified Description: A missing length check in multiple locations may allow for a persistent denial-of-service DoS condition on the device. Exploitation of this issue could lead to a local denial of service without...

CVE-2025-20705

In monitorhang, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09989078; Issue ID: MSV-3964...

CVE-2025-22423

In ParseTag of dngifd.cpp, there is a possible way to crash the image renderer due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-22416

In onCreate of ChooserActivity.java , there is a possible way to view other users' images due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2025-35627

Name of the Vulnerable Software and Affected Versions: dng ifd.cpp affected versions not specified Description: A missing bounds check in the ParseTag function within dng ifd.cpp may lead to a crash of the image renderer, potentially resulting in a remote denial of service. Exploitation does not...