CVE-2014-9910

CVE-2014-9910 is a local elevation-of-privilege in the Broadcom Wi‑Fi driver on Android that could allow a malicious local app to run code in kernel context. The issue requires compromising a privileged process and affects Android, with no specific patch version or remediation provided in the sup...

CVE-2014-9925

CVE-2014-9925 : In HDR on Android CAF builds using the Linux kernel, there is a vulnerability described as a Buffer Copy without Checking Size of Input. Affected component is HDR handling in CAF Android releases; root cause is unchecked input size during a copy operation, potentially enabling mem...

CVE-2014-9955

CVE-2014-9955 is an elevation-of-privilege vulnerability affecting Android, specifically in Qualcomm closed‑source components with the Android kernel as the platform. The connected CVE records confirm the issue is associated with Qualcomm closed‑source components and that fixes are not delivered ...

CVE-2014-9966

CVE-2014-9966 describes a TOCTOU race condition in Android CAF Secure Display implemented in the Linux kernel used by Android. The vulnerability affects Android releases using CAF’s Linux kernel and Secure Display, with impact on confidentiality, integrity, and availability as reflected in CVSS (...

CVE-2014-9967

CVE-2014-9967 describes an untrusted pointer dereference in the WideVine DRM component used by Android CAF builds that run on the Linux kernel. The vulnerability is located in WideVine DRM (a media/content protection feature) and is triggered by dereferencing an untrusted pointer, leading to pote...

CVE-2015-1527

CVE-2015-1527 is tied to an integer overflow in IAudioPolicyService.cpp in Android, enabling local privilege escalation via a crafted app (Android Bug ID 19261727). Public records consolidate this as a local‑privilege‑escalation flaw in the Android audio policy service. The connected sources refe...

CVE-2015-6603

CVE-2015-6603 affects libstagefright in Android prior to 5.1.1 LMY48T. A crafted media file could cause memory corruption in mediaserver and allow remote code execution or a denial of service. The issue is identified as internal bug 23227354. Android’s October 2015 bulletin documents multiple Rem...

CVE-2015-8938

CVE-2015-8938 affects the MSM camera driver in Qualcomm components on Nexus 6 devices, where input parameter validation is incomplete, enabling privilege escalation via a crafted application. The issue is documented across multiple sources (e.g., CNVD-2016-06244) as a Nexus 6 privilege-acquisitio...

CVE-2015-9008

CVE-2015-9008 is an elevation-of-privilege vulnerability in Qualcomm closed‑source components used by Android kernel (Android ID A-36384689). The issue is described as a privilege escalation in Qualcomm components; no public exploitation details are provided in the connected docs. Remediation is ...

CVE-2015-9014

CVE-2015-9014 is an Elevation of Privilege in Qualcomm closed‑source components affecting Android kernel. The vulnerability is described as a privilege escalation within Qualcomm components integrated into Android; impact is elevated privileges without user interaction. The Connected documents co...

CVE-2015-9024

CVE-2015-9024 concerns Android CAF builds: in all CAF Android releases that use the Linux kernel, certain interfaces were improperly exposed to QTEE applications. The connected documents do not provide a specific affected product/version beyond this CAF/Linux-kernel context, nor do they describe ...

CVE-2015-9031

CVE-2015-9031 arises in all Android CAF builds that use the Linux kernel, where a TZ memory address is exposed to the high-level OS (HLOS) by the HDCP component. The root cause is a leakage of a TZ memory address, enabling information disclosure within the system. The available documents do not s...

CVE-2015-9054

Technical details for CVE-2015-9054 are not provided in the connected documents; no explicit affected products, versions, root cause, or fixes are disclosed here. Monitor for updates.

CVE-2016-0844

The CVE-2016-0844 issue affects the Qualcomm RF driver in Android 6.x prior to 2016-04-01. The underlying flaw is improper restriction of socket ioctl calls, enabling a local attacker with a crafted app to execute code with kernel context privileges (privilege escalation). This vulnerability is l...

CVE-2016-10280

CVE-2016-10280 is an elevation of privilege in the MediaTek thermal driver that could allow a local malicious Android app to execute code in the kernel. The issue requires compromising a privileged process and is rated High. Per the 2017-05 Android bulletin, the patch is not publicly available an...

CVE-2016-11048

Technical details for CVE-2016-11048 are not publicly available in the provided documents. Monitor for updates.

CVE-2016-2412

CVE-2016-2412 affects Skia in Android System_server. The issue arises from include/core/SkPostConfig.h (SkPostConfig) being mishandled during certain crashes, allowing privilege escalation via a crafted application and potentially granting Signature or SignatureOrSystem access. Affected versions ...

CVE-2016-2476

CVE-2016-2476 affects Mediaserver in Android (versions 4.x up to 4.4.3, 5.0.x up to 5.0.1, 5.1.x up to 5.1.0, and 6.x prior to 2016-06-01). The issue is improper validation of OMX buffer sizes, enabling a local attacker with a crafted app to gain privileges (Signature or SignatureOrSystem). The v...

CVE-2016-2481

CVE-2016-2481 affects the mm-video-v4l2 venc component in Android Mediaserver. It arises from how Mediaserver mishandles a buffer count, enabling a local attacker to gain privileges (Signature or SignatureOrSystem) via a crafted app. Affected are Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1....

CVE-2016-2486

CVE-2016-2486 affects Android Mediaserver’s libstagefright component (mp3dec/SoftMP3.cpp). The flaw stems from not validating the relationship between allocated memory and the frame size, enabling memory corruption that can be exploited by a crafted Android app to gain privileges (Signature or Si...

CVE-2016-2500

CVE-2016-2500 targets Android: Activity Manager in Android 5.0.x (before 5.0.2), 5.1.x (before 5.1.1), and 6.x (before 2016-06-01) fails to terminate process groups, enabling a crafted app to disclose sensitive information. Root cause: improper handling within Activity Manager. Impact as describe...

CVE-2016-3812

CVE-2016-3812 describes an information-disclosure vulnerability in the MediaTek video codec driver on Android One devices, prior to 2016-07-05. A crafted app could cause data leakage to the attacker via the MediaTek/Android pipeline (Android internal bug 28174833 and MediaTek internal bug ALPS026...

CVE-2016-3834

CVE-2016-3834 affects Android camera APIs where, on Android 4.x up to 4.4.4, 5.0.x up to 5.0.2, 5.1.x up to 5.1.1, and 6.x prior to the August 2016 patch, a crafted app could bypass access restrictions and disclose details about ANW buffer addresses. This is a local information-disclosure issue i...

CVE-2016-3839

CVE-2016-3839 affects Android Bluetooth stack across multiple releases: Android 4.x up to 4.4.3, 5.0.x up to 5.0.1, 5.1.x up to 5.1.0, and 6.x prior to 2016-08-01. A crafted application can send a signal to the Bluetooth process, exploiting internal bug 28885210 to cause a denial of service (loss...

CVE-2016-3842

The CVE-2016-3842 issue affects the Qualcomm GPU driver in Android on Nexus 5X, 6, and 6P prior to 2016-08-05. A crafted app could escalate privileges locally due to Android internal bug 28377352 and Qualcomm bug CR1002974. Severity is high (local, user interaction required per CVE data). The pat...

CVE-2016-3863

CVE-2016-3863 affects Android's MediaMuxer/LibStagefright AVCC reassembly code (Utils.cpp). Multiple stack-based buffer overflows in the AVCC reassembly path can be triggered by a crafted media file, enabling arbitrary code execution. Affected Android versions include 4.x prior to 4.4.4; 5.0.x pr...

CVE-2016-3881

CVE-2016-3881 affects libvpx in mediaserver (Android) where the decoder_peek_si_internal function in vp9/vp9_dx_iface.c can trigger a denial of service via a crafted media file. Affected products/versions include Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09...

CVE-2016-3893

CVE-2016-3893 affects the Qualcomm sound codec on Android devices (Nexus 6P) prior to 2016-09-05. The vulnerability lies in the wcdcal_hwdep_ioctl_shared function in sound/soc/codecs/wcdcal-hwdep.c, which does not properly copy firmware data, enabling a crafted application to cause information di...

CVE-2016-3906

CVE-2016-3906 is an information-disclosure vulnerability affecting Qualcomm components in Android (GPU driver, power driver, SMSM Point-to-Point driver, and sound driver) prior to 2016-11-05. A local malicious application could access data outside its permission levels after compromising a privil...

CVE-2016-3909

The CVE-2016-3909 entry affects Android’s Mediaserver (libstagefright) SoftMPEG4 in the MediaServer component. The vulnerability enables privilege escalation via a crafted application and is tied to specific Android versions: 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 20...

CVE-2016-3910

CVE-2016-3910 affects Android Mediaserver’s SoundTriggerHwService.cpp in the MediaServer component. The issue allows a local attacker to gain privileges by convincing the user to run a crafted application. Affected versions include Android 5.0.x prior to 5.0.2, 5.1.x prior to 5.1.1, 6.x prior to ...

CVE-2016-3920

CVE-2016-3920 affects Android Mediaserver (libstagefright) via id3/ID3.cpp. A crafted file could cause a denial of service (device hang or reboot) in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01. Connected sources confirm the issue and note that...

CVE-2016-3927

CVE-2016-3927 is a Qualcomm component elevation/privilege issue described in the 2016-10-01 Android bulletin. Affected devices are Nexus 5X and Nexus 6P; the root cause is listed as Qualcomm internal (A-28823244) with Critical impact. The bulletins do not publicly disclose the exact vulnerability...

CVE-2016-3930

CVE-2016-3930 concerns the NVIDIA MMC test driver on Android (Nexus 9) where a crafted app can exploit a NULL pointer dereference in the MMC test driver to gain privileges locally. Affected component: NVIDIA Tegra kernel/NVIDIA MMC test driver; vulnerability type: elevation of privilege. CVSS see...

CVE-2016-3933

Summary (CVE-2016-3933): Elevation of privilege in Mediaserver on Android allowed a crafted application to gain privileged execution. Affected devices include Nexus 9 and Pixel C. The issue is described in Android security bulletins as part of the October 2016 patch set, with security patch level...

CVE-2016-3934

CVE-2016-3934 affects the Qualcomm camera driver in Android prior to 2016-10-05 on Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, and Android One devices. The vulnerability resides in drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_cci_i2c.c which relies on variable-length arrays, enabling a cra...

CVE-2016-6677

CVE-2016-6677 is an information-disclosure flaw in the NVIDIA GPU driver on Nexus 9 devices running Android prior to 2016-10-05. A crafted application can cause the driver to leak sensitive data. The connected NVIDIA/Android entries corroborate this as an information-disclosure issue tied to the ...

CVE-2016-6686

CVE-2016-6686 is an information-disclosure vulnerability in the NVIDIA profiler on Android/Nexus 9 prior to 2016-10-05. A locally run, crafted application could leak sensitive information from the profiler. Connected sources indicate this issue is part of the Android 2016-10-01/2016-10-05 patch s...

CVE-2016-6715

CVE-2016-6715 is an elevation-of-privilege vulnerability in Android Framework APIs. A local malicious app could record audio without user permission on affected builds: Android 4.x before 4.4.4; 5.0.x before 5.0.2; 5.1.x before 5.1.1; 6.x before 2016-11-01; and 7.0 before 2016-11-01. Root cause i...

CVE-2016-6737

CVE-2016-6737 is an elevation of privilege in the Android kernel ION subsystem. A local malicious app could execute arbitrary code in kernel context on pre-2016-11-05 devices. The issue is deemed Critical and may enable a permanent device compromise, potentially requiring reflashing. Public remed...

CVE-2016-6748

CVE-2016-6748 describes an information-disclosure vulnerability in Qualcomm components used in Android (GPU driver, power driver, SMSM Point-to-Point driver, and sound driver). The flaw could allow a local malicious app to access data outside its permissions, with impact described as information ...

CVE-2016-6764

CVE-2016-6764 is a denial-of-service vulnerability in Android's Mediaserver. A specially crafted file could cause a device hang or reboot. The issue affects Android releases listed in the 2016-12-01 bulletin (4.4.4, 5.0.2, 5.1.1, 6.0/6.0.1, 7.0). The Android bulletin’s vulnerability details table...

CVE-2016-6910

The CVE-2016-6910 entry describes a local notification-listener disclosure affecting Samsung Galaxy S6 Edge devices running Android 5.0.2 initially. The vulnerability arises from a non-existent notification listener that, via a vulnerable system app, can allow a non-existent app (package name com...

CVE-2016-8396

CVE-2016-8396 is an information-disclosure vulnerability in the MediaTek video driver that could allow a local malicious Android app to access data outside its permissions. The root cause is within the MediaTek video driver; no exploit/vector details are provided in the supplied documents. Impact...

CVE-2016-8418

CVE-2016-8418 is a Critical remote code execution vulnerability in the Qualcomm crypto driver on Android, allowing an attacker to run arbitrary code in the kernel context. The 2017-02-05 Android bulletin documents the issue (references include A-32652894 and QC-CR#1077457) and indicates a patch w...

CVE-2016-8484

CVE-2016-8484 is an elevation-of-privilege vulnerability affecting Android kernel components within Qualcomm closed-source code. The available sources describe the issue as a privilege escalation in Qualcomm components used by Android, enabling code execution in the kernel context. No device- or ...

CVE-2017-0522

CVE-2017-0522 describes an elevation of privilege in a MediaTek APK on Android that could allow a local malicious app to execute code in a privileged process. The issue is characterized as High impact with local execution of arbitrary code within a privileged context. The affected component is th...

CVE-2017-0684

CVE-2017-0684 is the Android media framework elevation-of-privilege vulnerability. CNVD-2017-15960 describes it as a privilege-extraction flaw in Android’s media framework, enabling an attacker to trigger an out-of-bounds write. Affected products/versions include Android 6.0, 6.0.1, 7.0, 7.1.1, a...

CVE-2017-0728

CVE-2017-0728 is a denial-of-service vulnerability in the Android media framework, specifically the HEVC decoder. Affected products/versions: Android 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. The issue is classified as DoS in the Media framework with absence of explicit exploit details in the ...

CVE-2017-0755

CVE-2017-0755 is an Elevation of Privilege in Android’s libminikin library affecting Android versions 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 and 8.0. The CVSSv3 base score is 7.8 (High) with LOCAL attack vector, LOW complexity, no privileges required, user interaction required, and impact to...