CVE-2019-9258

This CVE-2019-9258 entry concerns Android 10 (wifilogd) with a possible out-of-bounds write due to a missing bounds check, enabling local elevation of privilege without user interaction. The issue affects wifilogd on Android-10 and is described as an out-of-bounds write that could elevate privile...

CVE-2018-9458

The CVE-2018-9458 issue affects Android 8.0–8.1, rooted in computeFocusedWindow/RootWindowContainer.java where focus can be on the wrong window, enabling interception of keypresses and local elevation of privilege with user interaction required for exploitation. This could expose user keystrokes ...

CVE-2018-9496

CVE-2018-9496 affects Android 9.0; vulnerability in ixheaacd_real_synth_fft_p3 within ixheaacd_esbr_fft.c causes an out-of-bounds write due to a missing bounds check, enabling remote code execution with user interaction. Exploitation details are not provided in the connected documents beyond this...

CVE-2018-9526

CVE-2018-9526 is a Framework information-disclosure issue affecting Android 7.0–9.x (patch levels 2019-06-01/2019-06-05). The root cause is an improperly configured setting in device configuration data that could allow remote disclosure of the device location without user interaction. The Android...

CVE-2018-9532

Technical details about CVE-2018-9532 are not publicly available in the provided connected documents. The entry references an out-of-bounds write in ixheaacd_env_extr.c affecting Android-9, but no further technical specifics or fixes are disclosed here; monitor for updates.

CVE-2018-9556

CVE-2018-9556 affects Android 9, where ParsePayloadHeader in payload_metadata.cc may overflow an integer, causing an out-of-bounds write and remote escalation of privilege with no user interaction. Exploitation details are not provided in the connected documents. The Android Security Bulletin not...

CVE-2018-9565

CVE-2018-9565 affects Android 9 (Pie). The vulnerability is in readBytes of xltdecwbxml.c, caused by an integer overflow that can trigger an out-of-bounds read. This may enable remote information disclosure without extra execution privileges and without user interaction. Exploitation details are ...

CVE-2018-9594

Summary: CVE-2018-9594 affects Android 7.x–9.x (7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9) in the llcp_link_proc_agf_pdu path of llcp_link.cc. Described as an out-of-bounds read caused by an integer overflow, enabling local information disclosure over NFC without user interaction. Impact (per sources): Loca...

CVE-2019-19273

The CVE-2019-19273 entry concerns Samsung devices with O(8.0)/P(9.0) and Exynos 8895 where RKP (Samsung Hypervisor EL2) permits arbitrary memory write operations. The affected component is the Samsung Hypervisor EL2 implementation (RKP) running on vulnerable Exynos-based Android variants. Underly...

CVE-2019-2030

CVE-2019-2030 is an Android 9 local Elevation of Privilege flaw: a use-after-free in removeInterfaceAddress within NetworkController.cpp that could allow remote code execution in the context of a privileged process without user interaction. The Android security bulletin groups this under System v...

CVE-2019-20574

CVE-2019-20574 : Local SQL injection in the Wi‑Fi history Content Provider on Samsung mobile devices running N(7.x), O(8.x), and P(9.0). The affected component is the Wi‑Fi history Content Provider; root cause described as an SQL injection vulnerability. Exploitation details, affected app version...

CVE-2019-20619

CVE-2019-20619 affects Samsung mobile devices running Android P (9.0) with Secure Startup, where keyboard suggested words may be leaked during startup. Samsung ID SVE-2019-13773. No public exploitation details or fixes are provided in the connected documents.

CVE-2019-20779

The CVE-2019-20779 entry concerns LG mobile devices running Android 7.x–9.0, where a TrustZone trusted application can crash when fed crafted input. The incident is reported across multiple sources (NVD, Red Hat, CVE listings) with the affected platform specified as LG Android devices, citing LVE...

CVE-2019-2079

CVE-2019-2079 affects Android 10 via the libxaac library, where an out-of-bounds read due to a missing bounds check could lead to information disclosure. The vulnerability targets a library/file within the Android stack and is exploitable with user interaction; no explicit remote code execution i...

CVE-2019-2132

CVE-2019-2132: Android vulnerability allowing an overlay of the VPN dialog by a malicious app, enabling local elevation of privilege. Exploitation requires user interaction and does not require additional execution privileges. Affected: Android versions 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9. The issue i...

CVE-2019-2190

CVE-2019-2190 affects LG's LAF component in the Android kernel, where a missing bounds check in a protected disk partition can cause local information disclosure via USB. Exploitation requires user privileges but not user interaction. The vulnerability is documented across multiple sources (NVD, ...

CVE-2019-2206

CVE-2019-2206 describes an out-of-bounds write in rw_i93_sm_set_read_only within rw_i93.cc caused by a missing bounds check, enabling remote code execution over NFC with no extra privileges and requiring user interaction. Affected product family is Android 8.0–10 (Android 8.0, 8.1, 9, 10) as list...

CVE-2019-2207

CVE-2019-2207 affects Android devices (Android 8.0–10) and is tied to a flaw in the nfa_hci_handle_admin_gate_rsp path of nfa_hci_act.cc. The issue is an out-of-bounds write caused by missing bounds checks in this function, enabling local elevation of privilege with system execution privileges re...

CVE-2019-9343

CVE-2019-9343 affects the Bluetooth stack in Android 10. The vulnerability arises from a missing bounds check that enables an out-of-bounds read, leading to remote information disclosure without requiring privileges or user interaction. Impact is confined to information disclosure; no exploitatio...

CVE-2019-9402

CVE-2019-9402 affects Android 10 Bluetooth: a missing bounds check in the Bluetooth stack can cause remote denial of service with no privileges and no user interaction. The vulnerability is triggered via network access, resulting in a DoS affecting availability (high in CVSS3). Exploitation detai...

CVE-2019-9424

CVE-2019-9424 affects Android 10: a vulnerability in the Screen Lock where the setting to hide the unlock pattern can be ignored under certain conditions, causing information disclosure. The vulnerability is listed in Android 10 security release notes and has NVD scores of 4.3 (CVSS2) and 7.5 (CV...

CVE-2020-0010

CVE-2020-0010 affects the FPC Fingerprint TEE in the Android kernel. The root cause is an out-of-bounds write due to a missing bounds check in fpc_ta_get_build_info within fpc_ta_kpi.c, enabling local escalation of privilege with SYSTEM-level privileges; no user interaction is required. Public re...

CVE-2020-0027

CVE-2020-0027 affects Android System component HidRawSensor (HidRawSensor.cpp), where HidRawSensor::batch can trigger an out-of-bounds write due to an unexpected switch fallthrough. This leads to local elevation of privilege with no extra user interaction. Impact is described as local, with compl...

CVE-2020-0158

CVE-2020-0158 affects Android 10 and is attributed to an out-of-bounds read in nfc_ncif_proc_t3t_polling_ntf within nfc_ncif.cc. The issue can lead to local information disclosure and, per the CVE entry, could enable System-level execution privileges without user interaction. The vulnerability is...

CVE-2020-0161

CVE-2020-0161 affects Android 10 (Android in the Pixel/Android Security Bulletin context) with a vulnerability in MPEG4Extractor.cpp (parseChunk). The underlying issue is resource exhaustion caused by improper input validation, leading to remote denial of service. Exploitation requires user inter...

CVE-2020-0168

CVE-2020-0168 affects Android 10, with a vulnerability in the Media Framework where impeg2_fmt_conv_yuv420p_to_yuv420sp_uv in impeg2_format_conv.c can trigger an out-of-bounds write due to a missing bounds check. This can enable remote code execution; exploitation is described as requiring user i...

CVE-2020-0184

CVE-2020-0184 affects Android 10 Media Framework; the vulnerability is an infinite loop in ihevcd_ref_list() inside ihevcd_ref_list.c caused by a missing bounds check, enabling remote DoS. Impact and exploitability: DoS with network attack surface per CVSS2, but CVSS3 notes user interaction is re...

CVE-2020-0212

CVE-2020-0212 is a concrete Android security vulnerability affecting Android 10. The issue is an out-of-bounds read caused by a use-after-free in InputBufferManager.cpp (_onBufferDestroyed), potentially enabling remote information disclosure with no execution privilege, requiring user interaction...

CVE-2020-0265

CVE-2020-0265 describes a local information-disclosure vulnerability in the Telephony component on Android 11, caused by missing permission checks that could leak sensitive data without user interaction. The NVD entry notes LOCAL attack vector, LOW attack complexity, and a PARTIAL confidentiality...

CVE-2020-0269

In CVE-2020-0269, Android Auto Settings contains an unsafe PendingIntent allowing a local information disclosure. Affected: Android 11 (Android Auto Settings). Root cause: permission bypass enabling information leakage without user interaction, though user privileges are required. Exploitation is...

CVE-2020-0270

CVE-2020-0270 affects Tremolo in Android-11, with an out-of-bounds read due to a missing bounds check that could lead to remote information disclosure. Exploitation requires user interaction; impact is information disclosure without extra execution privileges. This entry is supported by multiple ...

CVE-2020-0271

CVE-2020-0271 affects Android 11 and is listed in Android 11 security release notes under System as an Elevation of Privilege (EoP) issue. The vulnerability arises from an insecure default value in the Settings app, enabling local escalation of privilege and tapjacking with user interaction requi...

CVE-2020-0279

CVE-2020-0279 affects Android 11 via the AAC parser. The vulnerability is an out-of-bounds read caused by a missing bounds check, leading to remote information disclosure with no full compromise; exploitation requires user interaction. The issue is documented in Android 11 release notes under the...

CVE-2020-0335

The CVE-2020-0335 entry affects Android 11 via the NFC subsystem. The root cause is an out-of-bounds write caused by a missing bounds check in NFC handling, enabling local escalation to System privileges and potentially firmware compromise. The vulnerability is annotated as requiring no user inte...

CVE-2020-0350

CVE-2020-0350 affects Android 11 and is triggered by an out-of-bounds write in the NFC path due to a missing bounds check. The vulnerability could enable local elevation of privilege with system-level execution and potentially compromise firmware, with no user interaction required. Affected compo...

CVE-2020-0356

CVE-2020-0356 affects the Android Audio HAL. The issue is an out-of-bounds write caused by an incorrect bounds check, enabling local privilege escalation with system-level execution privileges. Exploitation does not require user interaction. The vulnerability is documented across multiple sources...

CVE-2020-0496

CVE-2020-0496 : The issue is a memory corruption in CPDF_RenderStatus::LoadSMask (cpdf_renderstatus.cpp) leading to a use-after-free and local information disclosure without requiring user interaction on Android 11. Public references in connected documents confirm the vulnerable component and imp...

CVE-2020-12747

CVE-2020-12747 relates to Samsung mobile devices with Q(10.0) using Exynos980/9630 and Exynos990/9830. The issue is a heap-based buffer overflow in the Bootloader caused by mishandling of specific commands. The vulnerability affects the boot process and could lead to unauthorized code execution a...

CVE-2020-25055

CVE-2020-25055 affects Samsung mobile devices running O(8.x), P(9.0) and Q(10.0). The issue resides in the persona service, where an unprivileged SecureFolder process can bypass admin restrictions in KnoxContainer. Public details consistently indicate a high-severity impact (NVD CVSS v3.1: 9.8, N...

CVE-2020-25060

Technical details about CVE-2020-25060 are not publicly available in the provided documents. Monitor for updates from vendors and security advisories.

CVE-2020-25061

CVE-2020-25061 affects LG mobile devices running Android 9–10 on Verizon’s network. The flaw resides in the lge_property mechanism, which allows property overwrites, revealing a root cause related to improper handling of property writes. Reported impact includes partial confidentiality, integrity...

CVE-2020-27051

CVE-2020-27051 is an out-of-bounds write caused by an integer overflow in NFA_RwI93WriteMultipleBlocks of nfa_rw_api.cc. Affects Android 11; the privilege impact is local with partial confidentiality/integrity/availability, and exploitation requires user interaction. CVSSv3.1 base score 7.8 (HIGH...

CVE-2020-27055

The CVE-2020-27055 vulnerability affects Android 11, specifically in WifiConfigController.java and WifiConfigController2.java. The issue arises from improper input validation in isSubmittable and showWarningMessagesIfAppropriate, leading to an insecure WiFi configuration and potential remote info...

CVE-2020-35549

Technical details about CVE-2020-35549 are not publicly available in the provided connected documents. Monitor for updates.

CVE-2021-0355

CVE-2021-0355 affects Android 11 in the kisd component. The issue is an out-of-bounds write caused by an integer overflow, enabling local escalation of privilege with SYSTEM execution privileges required. Exploitation does not require user interaction. The vulnerability is documented across multi...

CVE-2021-0386

CVE-2021-0386 affects Android 11 in the UsbConfirmActivity onCreate, enabling a tapjacking vector due to an insecure default value. The vulnerability could allow local escalation of privilege with user interaction required for exploitation (ATT&CK: Local, UI: Required). The issue is documented ac...

CVE-2021-0388

CVE-2021-0388 affects Android 11 and is tied to the ImsPhoneCallTracker.java onReceive path, where a misappropriation of data usage can occur due to an incorrect broadcast handler. This can enable local escalation of privilege by attributing video‑call data to the wrong app, without requiring any...

CVE-2021-0457

CVE-2021-0457 targets the FingerTipS touch screen driver in the Android kernel and describes an out-of-bounds write caused by a heap buffer overflow, enabling local privilege escalation to SYSTEM with no user interaction required. Public sources (NVD entry, ZDI advisory) corroborate a heap-based ...

CVE-2021-0463

CVE-2021-0463 concerns Google Android’s kernel component where in convertToHidl (convert.cpp) an out-of-bounds read can occur due to uninitialized data from ReturnFrameworkMessage. This issue may disclose local information without extra execution privileges and requires user interaction to exploi...

CVE-2021-0489

CVE-2021-0489: In Android’s memory management driver, a missing bounds check enables an out-of-bounds write. This could allow local escalation of privilege without user interaction. Affected products/versions are tied to Android SoCs; the vulnerability is listed in the Android May 2021 security b...