CVE-2017-9677

CVE-2017-9677 affects Qualcomm components, specifically the Audio driver, in CAF Android builds using the Linux kernel. The issue arises in msm_compr_ioctl_shared where ddp->params_length can be accessed/modified by multiple threads without proper locking, enabling race conditions. If ddp->...

CVE-2017-9683

CVE-2017-9683 describes an integer overflow in Android for MSM/CAF Linux kernel when flashing a meta image if user-supplied image offset/size are too large. Affected: Android for MSM, Firefox OS for MSM, QRD Android with CAF Linux kernel (all CAF-based Android releases). Root cause: integer overf...

CVE-2017-9692

CVE-2017-9692 is tracked in multiple sources with a concrete reference to the Graphics driver in Google device updates, listing DoS (local) as the vulnerability type. The issue is described as a NULL pointer dereference that can occur when an atomic commit is issued on a writeback panel with a NU...

CVE-2018-11299

CVE-2018-11299 affects CAF WLAN host driver in Android/Linux kernel: when WLAN firmware does not fill the vdev id correctly in stats events, the driver may access an interface array without proper bounds checking, causing invalid memory access and potentially kernel panic or page fault. Connected...

CVE-2018-11965

Technical details about CVE-2018-11965 are not publicly provided in the connected documents. Available entries repeat the vulnerability description without concrete affected products, versions, root cause, or fixes. Monitor for updates from official advisories.

CVE-2018-21042

CVE-2018-21042 concerns Samsung mobile devices running N(7.x), O(8.x), and P(9.0). The issue is that Dual Messenger can install an arbitrary APK, leading to privileged code execution. Affected component/feature: Dual Messenger on Samsung devices. Root cause: exploitation arises from ability to in...

CVE-2018-21076

CVE-2018-21076 concerns Samsung mobile devices with N(7.x) Exynos8890/8895 SoCs, where a modified trustlet in the Secure Driver can disclose a KASLR offset. The core issue is information disclosure rather than code execution, with a local access vector implied by the need to interact with the Sec...

CVE-2018-21089

CVE-2018-21089 affects Samsung mobile devices running N(7.x) on MT6755/MT6757 Mediatek chipsets. The root cause is an integer overflow in the bootloader related to the download offset control, enabling arbitrary code execution. The entry notes a Samsung ID SVE-2017-10732 (Jan 2018). Impact is des...

CVE-2018-3562

CVE-2018-3562: A buffer over-read can occur while processing a FILS authentication frame in Android CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux kernel. Documented in NVD as a DoS vulnerability within WLAN, with local attack vector and availability impact. Affected: Andr...

CVE-2018-5832

CVE-2018-5832 infers a race condition in a camera driver ioctl handler on CAF Android builds using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android). The root cause is a Use-After-Free condition triggered by a race in the driver path prior to the security patch level 2018-06-05....

CVE-2018-9448

CVE-2018-9448 affects Android 8.0 and 8.1, with a vulnerability in avct_bcb_msg_ind (avct_bcb_act.cc) caused by a missing bounds check that could enable remote information disclosure without user interaction or additional privileges. The issue is categorized as an information-disclosure risk (no ...

CVE-2018-9455

CVE-2018-9455 affects Android 6.0–8.1. The issue is an out-of-bounds read in sdpu_extract_attr_seq within sdp_utils.cc, caused by an incorrect bounds check, enabling remote denial of service without user interaction. The Android bulletin lists CVE-2018-9455 under System DoS with patch level 2018-...

CVE-2018-9474

CVE-2018-9474 is a local elevation-of-privilege in Android’s Media Framework, triggered by a serialization/deserialization mismatch in MediaPlayer.writeToParcel. Affected software includes Android 7.0–9; exploited via crafted media content with no user interaction. The issue is documented in the ...

CVE-2018-9504

CVE-2018-9504 affects Android Bluetooth SDP discovery: a possible out-of-bounds write in sdp_copy_raw_data (sdp_discovery.cc) due to an incorrect bounds check, enabling remote code execution with no user interaction. Affected Android versions include 7.0–9.0; exploitation status and specific patc...

CVE-2018-9532

Technical details about CVE-2018-9532 are not publicly available in the provided connected documents. The entry references an out-of-bounds write in ixheaacd_env_extr.c affecting Android-9, but no further technical specifics or fixes are disclosed here; monitor for updates.

CVE-2018-9556

CVE-2018-9556 affects Android 9, where ParsePayloadHeader in payload_metadata.cc may overflow an integer, causing an out-of-bounds write and remote escalation of privilege with no user interaction. Exploitation details are not provided in the connected documents. The Android Security Bulletin not...

CVE-2018-9591

The CVE-2018-9591 issue affects Android components: the function bta_hh_ctrl_dat_act in bta_hh_act.cc, across Android 7.0, 7.1.1, 7.1.2, 8.0, 8.1, and 9.0. It is caused by a missing bounds check that allows an out-of-bounds read, enabling remote information disclosure without extra privileges, wi...

CVE-2018-9593

Technical details about CVE-2018-9593 are not publicly available in the provided connected documents. Monitor for updates from official sources.

CVE-2019-19273

The CVE-2019-19273 entry concerns Samsung devices with O(8.0)/P(9.0) and Exynos 8895 where RKP (Samsung Hypervisor EL2) permits arbitrary memory write operations. The affected component is the Samsung Hypervisor EL2 implementation (RKP) running on vulnerable Exynos-based Android variants. Underly...

CVE-2019-2030

CVE-2019-2030 is an Android 9 local Elevation of Privilege flaw: a use-after-free in removeInterfaceAddress within NetworkController.cpp that could allow remote code execution in the context of a privileged process without user interaction. The Android security bulletin groups this under System v...

CVE-2019-20548

CVE-2019-20548 affects Samsung mobile devices with P(9.0) software on Qualcomm chipsets. The root cause is a buffer overflow in the bootloader , enabling potential arbitrary execution on affected devices. The vulnerability has a high to critical impact profile (NVD CVSS v3.1: 9.8, network attack ...

CVE-2019-20574

CVE-2019-20574 : Local SQL injection in the Wi‑Fi history Content Provider on Samsung mobile devices running N(7.x), O(8.x), and P(9.0). The affected component is the Wi‑Fi history Content Provider; root cause described as an SQL injection vulnerability. Exploitation details, affected app version...

CVE-2019-20578

CVE-2019-20578 affects Samsung mobile devices running P 9.0 on Exynos 9820 chipsets. The root cause is a buffer overflow that occurs when loading the UH Partition during Secure Boot. Impact is high confidentiality, integrity, and availability concerns for Secure Boot processes on affected models....

CVE-2019-2121

CVE-2019-2121 : A race condition in ActivityManagerService.attachApplication on Android 9 (Pie) can lead to local escalation of privilege without extra privileges; no user interaction required. Affected component is the framework entry point for app attachment. The core issue is a race in attachi...

CVE-2019-2132

CVE-2019-2132: Android vulnerability allowing an overlay of the VPN dialog by a malicious app, enabling local elevation of privilege. Exploitation requires user interaction and does not require additional execution privileges. Affected: Android versions 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9. The issue i...

CVE-2019-2206

CVE-2019-2206 describes an out-of-bounds write in rw_i93_sm_set_read_only within rw_i93.cc caused by a missing bounds check, enabling remote code execution over NFC with no extra privileges and requiring user interaction. Affected product family is Android 8.0–10 (Android 8.0, 8.1, 9, 10) as list...

CVE-2019-9268

CVE-2019-9268 affects Android’s media stack (libstagefright) with a use-after-free caused by improper locking, enabling local escalation of privilege in the media server without extra privileges. The issue is tied to Android 10 (Android-10) and is documented in the Android 10 Security Release Not...

CVE-2019-9316

CVE-2019-9316 affects Android’s media stack via the libstagefright component, where a missing variable initialization is cited as the root cause. This flaw could enable remote information disclosure without extra privileges, with user interaction required for exploitation. Affected product is And...

CVE-2019-9343

CVE-2019-9343 affects the Bluetooth stack in Android 10. The vulnerability arises from a missing bounds check that enables an out-of-bounds read, leading to remote information disclosure without requiring privileges or user interaction. Impact is confined to information disclosure; no exploitatio...

CVE-2020-0025

CVE-2020-0025 affects Android 11, involving a vulnerability in PackageManagerService.deletePackageVersionedInternal that can bypass permissions to exit Screen Pinning. The issue enables local privilege escalation without extra execution privileges and does not require user interaction. NVD and An...

CVE-2020-0031

Technical details for CVE-2020-0031 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2020-0060

CVE-2020-0060 is documented as a SQL injection-based permission bypass in Android 10. The affected components are the SmsProvider.java and MmsSmsProvider.java query paths, enabling a local information disclosure with system-level privileges and no user interaction required for exploitation. The v...

CVE-2020-0083

The CVE-2020-0083 issue affects Android 10 where a logic error in setRequirePmfInternal within sta_network.cpp can cause a default value to be misapplied, enabling a remote DoS without user interaction. The Pixel bulletin and Android bulletin indicate this belongs to the System component with a D...

CVE-2020-0097

CVE-2020-0097 affects Android Framework (PackageManagerService.java). A missing condition for system apps permits a local privilege escalation from a User account with no user interaction required. Exploitation status is not detailed in the provided documents. The vulnerability is listed in Andro...

CVE-2020-0119

CVE-2020-0119 affects Android 10 and is caused by improper certificate validation in WifiConfigManager.java (addOrUpdateNetworkInternal and related functions), enabling a possible man-in-the-middle attack that could lead to remote information disclosure. Exploitation requires user interaction, an...

CVE-2020-0126

CVE-2020-0126 affects Android 10 and is described across multiple sources as a use-after-free caused by a race in DrmPlugin.cpp. The vulnerability could enable local code execution with System privileges and does not require user interaction. The Connected documents confirm the issue and its Andr...

CVE-2020-0168

CVE-2020-0168 affects Android 10, with a vulnerability in the Media Framework where impeg2_fmt_conv_yuv420p_to_yuv420sp_uv in impeg2_format_conv.c can trigger an out-of-bounds write due to a missing bounds check. This can enable remote code execution; exploitation is described as requiring user i...

CVE-2020-0202

The CVE-2020-0202 issue affects Android 11 and is tied to onHandleIntent in TraceService.java. The root cause is a missing permission check that bypasses developer settings requirements for capturing system traces, allowing local elevation of privilege. Exploitation requires user interaction; no ...

CVE-2020-0236

CVE-2020-0236 affects Android 10 and specifically the A2DP_GetCodecType path in the a2dp_codec_config. The issue is an out-of-bounds read caused by improper input validation, leading to possible remote information disclosure without extra execution privileges and without user interaction. The vul...

CVE-2020-0265

CVE-2020-0265 describes a local information-disclosure vulnerability in the Telephony component on Android 11, caused by missing permission checks that could leak sensitive data without user interaction. The NVD entry notes LOCAL attack vector, LOW attack complexity, and a PARTIAL confidentiality...

CVE-2020-0350

CVE-2020-0350 affects Android 11 and is triggered by an out-of-bounds write in the NFC path due to a missing bounds check. The vulnerability could enable local elevation of privilege with system-level execution and potentially compromise firmware, with no user interaction required. Affected compo...

CVE-2020-10832

The CVE-2020-10832 entry describes a vulnerability in Samsung mobile devices with P(9.0) Exynos chipsets where Kernel Wi-Fi drivers allow out-of-bounds Read/Write operations (buffer overflow). This affects the kernel Wi-Fi subsystem and is tied to several Samsung internal IDs (SVE-2019-16125, 161...

CVE-2020-10849

Technical details (affected components, root cause, impact, or fixes) are not publicly disclosed in the provided documents. Monitor for updates from official sources as additional details may be published later.

CVE-2020-12747

CVE-2020-12747 relates to Samsung mobile devices with Q(10.0) using Exynos980/9630 and Exynos990/9830. The issue is a heap-based buffer overflow in the Bootloader caused by mishandling of specific commands. The vulnerability affects the boot process and could lead to unauthorized code execution a...

CVE-2020-25061

CVE-2020-25061 affects LG mobile devices running Android 9–10 on Verizon’s network. The flaw resides in the lge_property mechanism, which allows property overwrites, revealing a root cause related to improper handling of property writes. Reported impact includes partial confidentiality, integrity...

CVE-2020-35551

CVE-2020-35551 describes a RPMB state-change vulnerability in Samsung mobile devices with Exynos (O(8.x), P(9.0), Q(10.0)) where an unauthorized RPMB write can be replayed, enabling replay attacks. Root cause centers on RPMB state manipulation; the issue is related to CVE-2020-13799. Documented i...

CVE-2021-0343

CVE-2021-0343 affects the kisd component in Android 11. The issue is an out-of-bounds write caused by a missing bounds check, enabling local escalation to System privileges without user interaction. The vulnerability impact is described as high for confidentiality, integrity, and availability in ...

CVE-2021-0350

CVE-2021-0350 affects Android devices running Android-8.1, Android-9, Android-10, and Android-11. The issue is in the generic governance of input handling in the component described as “ged,” caused by improper input validation, which can cause a local denial of service and requires system execut...

CVE-2021-0362

CVE-2021-0362 affects Android 11 as described across multiple sources. The vulnerability is a memory corruption via a stack buffer overflow in the aee component, enabling local privilege escalation with System-level execution privileges. Exploitation does not require user interaction. Patch ALPS0...

CVE-2021-0364

CVE-2021-0364 affects Android (Android-10 and Android-11) due to a command-injection vulnerability in mobile_log_d caused by improper input validation. The issue can enable local escalation of privileges with System execution privileges required and does not require user interaction. Patch ALPS05...