CVE-2022-20143

CVE-2022-20143 concerns a DoS vulnerability in Android’s ZenModeHelper.addAutomaticZenRule due to resource exhaustion. The initial entry and connected documents identify the root cause as resource exhaustion in addAutomaticZenRule and describe a local denial of service that can be triggered with ...

CVE-2023-20933

CVE-2023-20933 affects Google Android: a use-after-free in several MediaCodec.cpp functions can lead to memory corruption and local elevation of privilege without extra exploitation steps. Affected are Android 10–13 (including 12L/12). The issue is described as a memory corruption vulnerability i...

CVE-2023-21252

CVE-2023-21252 affects Android’s WifiConfigurationUtil.java, specifically its validatePassword function. The root cause is improper input validation, which can cause the device to boot loop and result in local denial of service without requiring user interaction. The issue is categorized as DoS w...

CVE-2024-0050

CVE-2024-0050 involves an out-of-bounds write in the getConfig path of SoftVideoDecoderOMXComponent.cpp. The issue is triggered via missing validation and results in a local, non‑security impact with no additional execution privileges required (no user interaction). Affected detail: the vulnerabi...

CVE-2016-3841

CVE-2016-3841 affects the Linux kernel IPv6 stack before 4.3.3. A crafted sendmsg can mishandle options data, allowing local users to gain privileges or cause a denial of service via a use-after-free leading to a system crash. Public documents (e.g., MiracleLinux AXSA-2016-1135:09 and Unity Linux...

CVE-2016-5300

Expat CVE-2016-5300 is a denial-of-service vulnerability in the Expat XML parser caused by insufficient entropy used for hash initialization. The issue allows context-dependent attackers to cause CPU exhaustion via crafted identifiers in XML documents. Connected material confirms this as an Expat...

CVE-2019-2106

CVE-2019-2106 affects Android’s Media framework: in ihevcd_sao_shift_ctb of ihevcd_sao.c, a missing bounds check can cause an out-of-bounds write leading to remote code execution. Impacted Android versions include 7.0, 7.1.1, 7.1.2, 8.0, 8.1, and 9. The issue is described in the July 2019 Android...

CVE-2021-39703

CVE-2021-39703 affects Android 12 through a flaw in UsbDeviceManager.updateState that can cause unauthorized file access via a confused deputy, enabling local EoP with no extra execution privileges and no user interaction. Public fix references appear in Android security bulletins; patch levels 2...

CVE-2022-20361

CVE-2022-20361 describes a vulnerability in Android Bluetooth stack (btif_dm_auth_cmpl_evt in btif_dm.cc) related to Cross-Transport Key Derivation. Root cause is a weakness in the Bluetooth protocol implementation, enabling remote elevation of privilege with no user interaction. Affected product...

CVE-2023-21267

The CVE-2023-21267 issue affects Android’s KeyguardViewMediator.java in the framework, enabling bypass of lockdown mode via screen pinning due to a logic error. This leads to local information disclosure without extra privileges or user interaction. Exploitation can occur on devices with access t...

CVE-2023-40138

CVE-2023-40138 affects the FillUi component (FillUi.java) in Android, enabling information disclosure by viewing another user’s images via a confused deputy. The vulnerability can be exploited locally without user interaction, and the impact is local information exposure with no added executable ...

CVE-2024-40672

CVE-2024-40672 affects Android’s ChooserActivity.java, where a missing permission check in onCreate could bypass factory reset protections. This enables local elevation of privilege with no extra execution privileges or user interaction required. Documented impact is a local EoP; exploitation det...

CVE-2024-43097

CVE-2024-43097 : The issue is a possible out-of-bounds write in SkRegion.cpp in resizeToAtLeast caused by an integer overflow, which could lead to local privilege escalation with no user interaction required. The vulnerability is referenced across multiple advisories for Mozilla components (Firef...

CVE-2019-2092

CVE-2019-2092 affects the Android Framework, specifically DevicePolicyManagerService.java’s isSeparateProfileChallengeAllowed, where a missing permission check enables local elevation of privilege. Impact is local EoP with no extra privileges required, no user interaction needed. Affected version...

CVE-2019-2187

CVE-2019-2187 affects Android where an out-of-bounds read can occur in nfc_ncif_decode_rf_params in nfc_ncif.cc due to an integer underflow, enabling local information disclosure without user interaction. Affected Android versions include 7.1.1, 7.1.2, 8.0, 8.1, 9, and 10. The Red Hat and CVE rec...

CVE-2020-0432

CVE-2020-0432 affects the Android kernel networking.c function skb_to_mamac, where an integer overflow can cause an out-of-bounds write. The consequence specified is local privilege escalation with no extra execution privileges or user interaction required. The provided connected advisories (Unit...

CVE-2021-39623

CVE-2021-39623 (Android Media Framework) : An out-of-bounds write in SimpleDecodingSource.cpp (doRead) due to an incorrect bounds check could enable remote escalation of privilege with no user interaction. Affected: Android versions 9–12. Exploit risk is described by the CVE entry (CVSS up to 9.8...

CVE-2021-39667

CVE-2021-39667 is a vulnerability in the Android Media Framework. The issue arises from an out-of-bounds write caused by a heap buffer overflow in ih264d_parse_decode_slice (ih264d_parse_slice.c), enabling potential remote information disclosure. Exploitation requires user interaction. Affected p...

CVE-2021-39675

CVE-2021-39675 affects Android 12, involving a heap buffer overflow in GKI_getbuf (gki_buffer.cc). The root cause is an out-of-bounds write in a heap buffer, which could enable remote escalation of privilege with no user interaction. The impact is elevated privileges with high confidentiality/int...

CVE-2021-39689

CVE-2021-39689 is a local elevation-of-privilege vulnerability reported in Android 12, due to a logic error in multiple functions of odsign_main.cpp. It could allow a local attacker with system privileges to gain full control without user interaction. The Android bulletin notes this issue under t...

CVE-2021-39758

Summary of CVE-2021-39758 : In Android 12L, WindowManager could start a foreground activity from the background due to a missing permission check, enabling local elevation of privilege without user interaction. The Android bulletin classifies this issue under Framework/EoP with a moderate severit...

CVE-2022-20005

CVE-2022-20005 is an Android elevation-of-privilege issue in PackageInstallerSession.java (validateApkInstallLocked). The vulnerability allows a mismatch between running code and a parsed APK, enabling local privilege escalation with no user interaction required, on Android 10, 11, 12 and 12L. Th...

CVE-2023-21111

CVE-2023-21111 affects Android 11–13 and is caused by improper input validation in several functions of PhoneAccountRegistrar.java, enabling a local Denial of Service without extra privileges or user interaction. The available sources confirm the affected component and the root cause, and describ...

CVE-2023-40116

CVE-2023-40116 affects Android via a logic error in PipTaskOrganizer.java (onTaskAppeared), enabling bypass of background activity launch restrictions and resulting in local elevation of privilege without additional execution privileges or user interaction. Public sources in the Connected documen...

CVE-2019-2110

CVE-2019-2110 affects Android 9 (Android-9) and is tied to ScreenRotationAnimation.java. The vulnerability arises from a missing permission check in ScreenRotationAnimation, enabling local information disclosure without requiring user interaction. The NVD entry lists a reachable impact of PARTIAL...

CVE-2021-39709

CVE-2021-39709 is an Android 12 elevation-of-privilege issue. The root cause is an unsafe PendingIntent in SipAccountRegistry.java’s sendSipAccountsRemovedNotification, enabling a possible permission bypass. The vulnerability could allow local escalation to a higher privilege where attacker needs...

CVE-2023-21130

CVE-2023-21130 describes a buffer overflow in the Android Bluetooth stack (btm_ble_periodic_adv_sync_lost in btm_ble_gap.cc) that could allow remote code execution without user interaction or additional privileges on Android 13. Multiple sources consistently identify this as a Critical/RCE issue ...

CVE-2016-3822

CVE-2016-3822 affects jhead/libjhead (exif.c) across Android 4.x before 4.4.4, 5.x before 5.0.2/5.0.x, 5.1.x before 5.1.1, and 6.x before 2016-08-01. The issue is an out-of-bounds access via crafted EXIF data, enabling remote code execution or a denial of service. Public advisories and vendor upd...

CVE-2019-2184

CVE-2019-2184 affects Android’s Media framework, specifically PV_DecodePredictedIntraDC in dec_pred_intra_dc.cpp. The issue is an out-of-bounds write caused by a missing bounds check, leading to remote code execution with no special privileges required. Exploitation is described as requiring user...

CVE-2021-0928

CVE-2021-0928 concerns an Elevation of Privilege in Android’s Media Framework. The vulnerability arises from a mismatch in parcel serialization/deserialization in createFromParcel of OutputConfiguration.java due to improper input validation, allowing local privilege elevation with no authenticate...

CVE-2022-20115

The CVE-2022-20115 issue affects Android 12/12L and centers on TelephonyRegistry.java, in broadcastServiceStateChanged, where a missing permission check could disclose base station information without location permission. This enables local information disclosure with no user interaction required...

CVE-2022-20133

The CVE-2022-20133 entry affects Android (Android-10, 11, 12, 12L) in the AdapterService.java function setDiscoverableTimeout. The root cause is a missing permission check that enables bypassing user interaction, allowing local elevation of privilege with User privileges. Exploitation is claimed ...

CVE-2022-20218

CVE-2022-20218 affects Android 12/12L, with the PermissionController component vulnerable due to a logic error that can allow obtaining and retaining permissions without user consent. This yields local elevation of privilege and, per sources, requires user interaction to exploit. AOSP/Android Bul...

CVE-2022-20222

CVE-2022-20222 affects Google Android (Android-12/Android-12L). Root cause: in read_attr_value of gatt_db.cc, a missing bounds check allows an out-of-bounds write. Impact: remote code execution without privileges and no user interaction required; attack vector is over the network. Public referenc...

CVE-2022-20477

CVE-2022-20477 affects Android 13, due to a logic error in KeyguardNotificationVisibilityProvider.kt (shouldHideNotification) that can cause hidden notifications to be shown. This may enable local elevation of privilege with no extra execution privileges and no user interaction required. Public d...

CVE-2023-20909

CVE-2023-20909 describes a privilege-escalation flaw in Android’s RunningTasks.java: a missing privilege check could allow local information disclosure without requiring additional execution privileges. Affected: Android 11–13. Exploitation details, affected patches, and remediation are not speci...

CVE-2017-13220

CVE-2017-13220 is described in connected advisories as an elevation of privilege in the Upstream kernel bluez affecting the Android kernel (Android ID A-63527053). The Nessus/OpenVAS entries reference this CVE alongside other Linux kernel CVEs, confirming a kernel-related issue, but the provided ...

CVE-2019-2226

An Android CVE-2019-2226 issue affects Android 8.0–10, where in device_class_to_int in device_class.cc an improper cast can cause an out-of-bounds read in the Bluetooth server, enabling local information disclosure with no user interaction required; patched via the 2019-12 Android security bullet...

CVE-2023-21134

The CVE-2023-21134 issue is an elevation-of-privilege in Android related to onCreate in ManagePermissionsActivity.java where a missing permission check could bypass factory reset protections. The vulnerability allows local escalation of privilege with physical access to a device that has been fac...

CVE-2024-40669

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2024-43767

CVE-2024-43767 affects Skia’s SkBlurMaskFilterImpl.cpp, specifically prepare_to_draw_into_mask, where a bound/size handling flaw can cause a heap overflow. The vulnerability can lead to remote code execution with no additional privileges; exploitation is described as not requiring user interactio...

CVE-2013-4710

CVE-2013-4710 affects Android WebView implementations (Android 3.0–4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank and other devices). The issue arises from improper WebView handling of addJavascriptInterface, enabling remote attackers to call arbitrary Java object methods or cause a ...

CVE-2021-39711

The CVE-2021-39711 entry concerns the Linux kernel (Android kernel variant in the initial report) with a vulnerability in bpf_prog_test_run_skb() in test_run.c. The root cause is an out-of-bounds read due to an Incorrect Size Value, which can lead to local information disclosure and potentially p...

CVE-2021-39714

CVE-2021-39714 affects the Ion Memory Manager in the Linux kernel used by Android. The issue in the function ion_buffer_kmap_get can cause a use-after-free due to an integer overflow, leading to local elevation of privilege with no user interaction. Impact is described as partial to high (per CVE...

CVE-2022-20135

CVE-2022-20135 is tied to a parcel format mismatch in GateKeeperResponse.java (writeToParcel), causing local elevation of privilege in Android. Affected versions span Android-10, Android-11, Android-12, and Android-12L, with exploitation described as requiring local access and no user interaction...

CVE-2022-20360

CVE-2022-20360 involves a missing permission check in the Android component SecureNfcPreferenceController.java (method setChecked), allowing local privilege escalation from the guest user without extra execution privileges. Affected products include Android 10, 11, 12, and 12L. The provided docum...

CVE-2022-20420

CVE-2022-20420 is an Android 13 elevation-of-privilege issue caused by a logic error in AppRestrictionController.java (getBackgroundRestrictionExemptionReason). The weakness could allow bypassing device policy restrictions with local access and no user interaction, granting high impact on confide...

CVE-2022-20462

CVE-2022-20462 is an Android local-privilege-escalation flaw located in phNxpNciHal_write_unlocked (phNxpNciHal.cc) caused by a missing bounds check that enables an out-of-bounds write. Affected: Android 10–13 (including 12L/13). Impact: local privilege escalation with high severity (C/H/I/A impa...

CVE-2022-20472

CVE-2022-20472 : In Android, the out-of-bounds read in LocaleListCache.cpp (toLanguageTag) arises from an incorrect bounds check and can lead to remote code execution with no user interaction. Affected Android versions include 10–13 (Android-10, Android-11, Android-12, Android-12L, Android-13). C...

CVE-2019-2091

CVE-2019-2091 affects the Android Framework, specifically GetPermittedAccessibilityServicesForUser in DevicePolicyManagerService.java. The issue is a permissions bypass due to a missing permission check, enabling local elevation of privilege without requiring extra permissions. Exploitation is de...