CVE-2021-0491

CVE-2021-0491 affects Android devices via a vulnerability in the memory management driver, specifically in the MTK/Multi-SoC ecosystem referenced in the 2021 Android security landscape. The issue is a missing permission check in the memory management driver, enabling local elevation of privilege ...

CVE-2021-0532

CVE-2021-0532 affects the Android memory management driver and is caused by a race condition that can lead to memory corruption and local escalation of privilege with no additional privileges or user interaction required. The description is consistent across multiple sources (NVD, Red Hat, CVE li...

CVE-2021-1038

CVE-2021-1038 describes a DoS via a tapjacking/overlay vulnerability in UserDetailsActivity of AndroidManifest.xml, affecting Android 9–12. The root cause is an overlay/tapjacking issue that can cause local denial of service with no extra privileges; exploitation requires user interaction per CVS...

CVE-2021-1039

CVE-2021-1039 affects Android Platform apps: NotificationAccessActivity in AndroidManifest.xml can enable a local elevation of privilege via a tapjacking/overlay trick. Affected: Android 9–12. Root cause: overlay/tapjacking allows bypass of user interaction requirements to gain higher privileges ...

CVE-2021-25393

CVE-2021-25393 affects Samsung's SecSettings prior to SMR May-2021 Release 1. The issue is improper sanitization of an incoming intent that lets a local attacker gain permissions to access system UID data. Affected component is the Settings app on Samsung Android devices; root cause relates to in...

CVE-2021-25409

CVE-2021-25409 describes an improper access in the Notification setting prior to Samsung SMR June‑2021 Release 1, allowing physically proximate attackers to set arbitrary notifications by physically configuring the device. The NVD entry indicates a low overall impact (CVSS v2: AV:L/AC:L/Au:N/I:P/...

CVE-2021-25450

CVE-2021-25450 describes a path traversal vulnerability in FactoryAirCommnadManger present before Samsung SMR Sep-2021 Release 1. An attacker could write files as the system UID via a remote socket by exploiting the vulnerable path handling in the component, leading to potential unauthorized file...

CVE-2021-25451

CVE-2021-25451 affects Android’s NetworkPolicyManagerService where a PendingIntent hijack can lead to exposure of IMSI data. The vulnerability is local, requiring user interaction, with a low-moderate CVSS (3.3 on 3.1, base score 3.3; confidentiality impact: Low). Root cause stated: manipulation ...

CVE-2021-25488

The CVE-2021-25488 issue affects Samsung devices via the modem interface driver’s recv_data() function. The root cause is a missing boundary check in the buffer handling, before the SMR Oct-2021 Release 1 patch, which permits an out-of-bounds (OOB) read. The vulnerability is documented across mul...

CVE-2022-20013

The CVE-2022-20013 entry concerns the vow driver with a race-condition that enables memory corruption and local escalation to System privileges. Affected component: vow driver (MediaTek context appears in related sources). Impact: local privilege escalation with high impact on confidentiality, in...

CVE-2022-20023

Technical details about CVE-2022-20023 are not publicly disclosed in the provided documents. Monitor for updates from vendors and security advisories for affected Bluetooth implementations; current sources reiterate a denial-of-service risk without exploitation specifics.

CVE-2022-26460

The CVE-2022-26460 issue affects the vow component (MediaTek vow) and arises from an incorrect bounds check that enables an out-of-bounds write. This could lead to local privilege escalation with system execution privileges required; no user interaction is needed for exploitation. The entry refer...

CVE-2022-32615

CVE-2022-32615 concerns an out‑of‑bounds write in the ccd component caused by uninitialized data, enabling local privilege escalation with system execution privileges required. No user interaction is needed. The vulnerability details are supported by multiple sources in the provided documents, wi...

CVE-2022-32650

In the CVE-2022-32650 entries, the vulnerability affects the MediaTek mtk-isp component, described as a use-after-free caused by a logic error. This leads to local escalation of privilege with System execution privileges required, and exploitation does not require user interaction. Remediation is...

CVE-2022-39103

The CVE-2022-39103 entry concerns the Gallery service, where a missing permission check is the root cause. This vulnerability could permit local denial of service without requiring additional execution privileges. Publicly provided documents reiterate the issue but do not specify affected version...

CVE-2022-39109

Technical details about CVE-2022-39109 are not publicly provided in the connected documents. Monitor for updates from vendors and advisories to obtain affected products, versions, and fixes.

CVE-2022-39128

CVE-2022-39128 corresponds to a vulnerability in the sensor driver that can cause a local denial of service in the kernel due to an out-of-bounds write from a missing bounds check. The connected documents consistently describe: (1) the flaw as a bounds-check omission in the sensor driver, (2) imp...

CVE-2022-42758

In CVE-2022-42758, multiple sources confirm a vulnerability in the WLAN driver (specifically a missing bounds check in the WLAN driver) that can cause local denial of service in WLAN services. Affected component is the WLAN driver (Unisoc chipset context appears in related tooling); root cause is...

CVE-2022-44424

CVE-2022-44424: The issue is a missing permission check in the music service that can trigger a local denial-of-service in the contacts service without requiring additional privileges. The available sources do not provide concrete exploit details, affected product versions, or a documented fix. M...

CVE-2022-47493

The CVE-2022-47493 entry describes a missing permission check in the UNISOC Soter service, enabling local denial of service with no additional execution privileges. The issue is tied to the soter service component and is described as a local vulnerability with a high availability impact, but no e...

CVE-2022-48368

CVE-2022-48368 affects the UNISOC chipsets’ audio service, with the root cause described as a missing permission check in the audio service. This could allow a local attacker with low privileges and no user interaction to escalate to a high-privilege level, potentially compromising confidentialit...

CVE-2022-48440

CVE-2022-48440 affects the dialer service. The root cause cited across connected documents is a missing permission check, enabling local denial of service with no additional execution privileges. The exposure is local (AV:L, PR:L) with a high impact on availability, and no exploitation details or...

CVE-2022-48445

CVE-2022-48445 concerns a vulnerability in the telephony service where a missing permission check could allow a local denial of service without requiring additional privileges. This is described consistently across multiple sources (NVD, Red Hat, CVE lists) as a local issue with no exploitation d...

CVE-2023-20624

CVE-2023-20624 describes a potential out-of-bounds write in the vow module due to an incorrect bounds check, which could enable local escalation of privilege with System execution privileges needed. User interaction is not required for exploitation. The issue affects MediaTek vow-related componen...

CVE-2023-20627

CVE-2023-20627 affects pqframework. The root cause is a missing bounds check leading to an out-of-bounds write that could allow local escalation to system privileges with no user interaction required. Impact is high for confidentiality, integrity, and availability per the cited CVSS details, with...

CVE-2023-20634

The connected sources describe CVE-2023-20634 as an input-validation based out-of-bounds write in Widevine, affecting MediaTek Widevine components. The root cause is improper input validation leading to local privilege escalation with system execution privileges, exploitable without user interact...

CVE-2023-20644

CVE-2023-20644 affects the ril module of MediaTek-based devices, where a missing bounds check causes an out-of-bounds read. This can lead to local information disclosure with potential system-privilege execution, with no user interaction required. Exploitation details are not provided in the docu...

CVE-2023-20648

CVE-2023-20648 affects the ril module in MediaTek chips. Root cause: missing bounds check causing an out-of-bounds read. Impact: local information disclosure with system execution privileges required; exploitation requires no user interaction. Patch ID: ALPS07628612. Multiple connected sources (N...

CVE-2023-20651

CVE-2023-20651 concerns the MediaTek apu component, where a missing bounds check enables an out-of-bounds read. This could lead to local information disclosure with System execution privileges needed; no user interaction is required. Public details consistently identify the vulnerability in apu a...

CVE-2023-20687

CVE-2023-20687 describes a race-condition that can cause a double free in the display DRM component, enabling local escalation of privileges to SYSTEM level without user interaction. The vulnerability is associated with a patch ID ALPS07570772 (Issue ID ALPS07570772). Exploitation status is not p...

CVE-2023-20700

CVE-2023-20700 affects Widevine in MediaTek chips. The vulnerability is described as an out-of-bounds write caused by a logic error, enabling local escalation of privilege with System execution privileges required; user interaction is not needed. Patch ID ALPS07643304 (Issue ALPS07643304) is refe...

CVE-2023-20785

Summary: CVE-2023-20785 describes a potential out-of-bounds write in the audio component due to a missing bounds check, enabling local escalation of privilege to system execution level. The vulnerability is described with no user interaction required. Affected component: Audio subsystem (MediaTek...

CVE-2023-20786

The CVE-2023-20786 entry concerns the MediaTek GPS component. A missing bounds check enables an out-of-bounds write, leading to local escalation of privilege with System execution privileges required. Exploitation does not require user interaction. A patch entry is noted as ALPS07767811 (Issue AL...

CVE-2023-20803

Summary: CVE-2023-20803 affects the imgsys component of MediaTek microprogram software, where memory corruption can occur due to improper input validation. This leads to local privilege escalation with system execution privileges required and user interaction needed for exploitation. Technical de...

CVE-2023-20815

The CVE-2023-20815 issue affects MediaTek WLAN software. Affected component: WLAN service; root cause: out-of-bounds write due to improper input validation. Impact: local escalation of privilege with System execution privileges required; no user interaction needed. Remediation: patch ALPS07453587...

CVE-2023-21297

CVE-2023-21297 affects SEPolicy in Android, enabling a permissions bypass to access the factory MAC address. This can cause local information disclosure with System execution privileges required and does not require user interaction. The connected Red Hat, CNVD, and other sources reiterate the sa...

CVE-2023-21329

CVE-2023-21329 describes an information disclosure in Android's Activity Manager caused by a missing permission check, enabling local access to whether an app is installed without user interaction. The Android 14 security release notes list this CVE under Framework with a Moderate severity and in...

CVE-2023-21346

CVE-2023-21346 is listed in Android 14 security release notes under Framework with Type ID and Moderate severity. The initial description indicates a local information-disclosure via Device Idle Controller side-channel (no user interaction required). Connected notes confirm framework-level classi...

CVE-2023-21370

CVE-2023-21370 is an elevation-of-privilege flaw in the Android Security Element API. The root cause is an integer overflow that enables an out-of-bounds write, leading to local privilege escalation with System privileges. Exploitation requires no user interaction. The affected component is the S...

CVE-2023-21383

Technical details (affected product/version/root cause/fix) for CVE-2023-21383 are not publicly available in the provided connected documents. Monitor for updates.

CVE-2023-32807

The CVE-2023-32807 issue affects the wlan service in MediaTek-based devices, caused by an improper input validation that leads to an out-of-bounds read. This could allow local information disclosure and requires system privileges, with no user interaction needed. The vulnerability details are sup...

CVE-2023-4164

CVE-2023-4164 affects Google Pixel Watch. It describes a local information-disclosure vulnerability caused by a missing permission check that could expose health data without extra privileges. Public details confirm the issue but do not provide exploit specifics. Impact is focused on confidential...

CVE-2023-44122

Summary (CVE-2023-44122): The LG LockScreenSettings app suffers a local-privelege issue where implicit intents can be intercepted by other apps on the same device, allowing theft of files via onActivityResult(). The attacker could cause the app to copy a received file to “/data/shared/dw/mycatego...

CVE-2023-44125

CVE-2023-44125 affects the Personalized service app (com.lge.abba). The issue is use of implicit PendingIntents without PendingIntent.FLAG_IMMUTABLE, which could enable an attacker’s app (with access to notifications) to hijack intents, intercept them, and then obtain permissions to content provi...

CVE-2023-52351

The CVE-2023-52351 issue affects the ril service in UNISOC chipsets, caused by a missing bounds check that enables an out-of-bounds write. This could lead to local denial of service with System execution privileges required. Affected component: ril service (UNISOC). Impact is described as local D...

CVE-2024-20074

CVE-2024-20074 concerns the component “dmc,” with a possible out-of-bounds write caused by a missing bounds check. This could enable local escalation of privilege to System privileges, with no user interaction required. Reported patches include Patch ID ALPS08668110 and Issue ID MSV-1333. Multipl...

CVE-2024-20108

CVE-2024-20108 affects the atci component (MediaTek chipsets). The vulnerability is an out-of-bounds write caused by a missing bounds check, enabling a local escalation of privilege with System execution privileges required. No user interaction is needed. A patch is referenced (Patch ID: ALPS0908...

CVE-2024-39437

CVE-2024-39437 concerns the UNISOC/linkturbonative service, where improper input validation enables a possible command injection. The underlying effect is local privilege escalation to SYSTEM level. Documented impact: local execution with high privileges; attacked component/process is the linktur...

CVE-2024-43766

CVE-2024-43766 describes an information-disclosure vulnerability in the Android Bluetooth stack caused by invalid error handling in multiple functions of a file named btm_ble_sec.cc . The issue could enable remote information disclosure to a proximal/adjacent attacker with no additional execution...

CVE-2025-22414

CVE-2025-22414 concerns a local elevation of privilege in FrpBypassAlertActivity.java due to a missing permission check, enabling FRP bypass without user interaction. Public sources identify the Wear OS/System component context and classify the issue as High severity with local access required (A...