CVE-2020-0271

CVE-2020-0271 affects Android 11 and is listed in Android 11 security release notes under System as an Elevation of Privilege (EoP) issue. The vulnerability arises from an insecure default value in the Settings app, enabling local escalation of privilege and tapjacking with user interaction requi...

CVE-2020-0273

CVE-2020-0273 describes an out-of-bounds write in hwservicemanager that may allow local privilege escalation without user interaction on Android 11. The root cause is freeing a wild pointer. Documented impact is local elevation of privilege with partial confidentiality/integrity/availability impa...

CVE-2020-0275

CVE-2020-0275 is a local elevation-of-privilege issue in Android 11 related to the MediaProvider. The root cause is a permissions bypass that allows an app to access ContentResolver and MediaStore entries it should not reach. Impact is a local elevation of privilege with no extra execution privil...

CVE-2020-0333

CVE-2020-0333 affects Android 11. The issue resides in the UrlQuerySanitizer component, where improper input validation could allow remote code execution. The vulnerability is exploitable with network access and does not require user interaction, with a high to critical impact depending on the me...

CVE-2020-12751

CVE-2020-12751 affects Samsung mobile devices running O(8.X), P(9.0), and Q(10.0). The Quram image codec library is vulnerable to memory overwrite via crafted JPEG data during decoding, enabling arbitrary code execution on impact. Public sources (NVD, Red Hat, CNVD, and related CVE records) consi...

CVE-2020-25058

CVE-2020-25058 affects LG mobile devices running Android 8.0–10, where the network_management service fails to properly restrict configuration changes. Root cause: insufficient access control in the network_management component. Impact is stated as high across confidentiality, integrity, and avai...

CVE-2020-25059

CVE-2020-25059 affects LG mobile devices running Android OS 7.2, 8.0, 8.1, 9, and 10. The issue is a service crash caused by incorrect input validation (LG ID LVE-SMP-200013). No further technical details (exploit paths, specific components, or remediation) are provided in the connected documents...

CVE-2020-27051

CVE-2020-27051 is an out-of-bounds write caused by an integer overflow in NFA_RwI93WriteMultipleBlocks of nfa_rw_api.cc. Affects Android 11; the privilege impact is local with partial confidentiality/integrity/availability, and exploitation requires user interaction. CVSSv3.1 base score 7.8 (HIGH...

CVE-2020-35548

CVE-2020-35548 affects Finder on Samsung mobile devices running Q(10.0). The issue arises from calling a non-existent provider, which allows an attacker to cause a denial of service. Connected sources corroborate the same description; no explicit remediation or patch details are provided in the s...

CVE-2020-35549

Technical details about CVE-2020-35549 are not publicly available in the provided connected documents. Monitor for updates.

CVE-2020-35555

The CVE-2020-35555 entry concerns LG mobile devices running Android 10 with dual-screen support. The issue is that, when a call is disconnected while the cover is closed, the device does not lock as expected, potentially leaving the device accessible without authentication. The details specify th...

CVE-2021-0344

CVE-2021-0344 concerns memory corruption in the mtkpower component in Android (Android-10 and Android-11). The root cause is a missing bounds check, enabling local escalation of privileges with System-level execution privileges required; exploitation does not require user interaction. The vulnera...

CVE-2021-0463

CVE-2021-0463 concerns Google Android’s kernel component where in convertToHidl (convert.cpp) an out-of-bounds read can occur due to uninitialized data from ReturnFrameworkMessage. This issue may disclose local information without extra execution privileges and requires user interaction to exploi...

CVE-2021-0491

CVE-2021-0491 affects Android devices via a vulnerability in the memory management driver, specifically in the MTK/Multi-SoC ecosystem referenced in the 2021 Android security landscape. The issue is a missing permission check in the memory management driver, enabling local elevation of privilege ...

CVE-2021-0529

CVE-2021-0529 affects MediaTek devices via the MTK memory management driver. The root cause is improper locking, leading to memory corruption and local escalation of privilege with no extra user interaction. Impact is described as local EoP with high severity (per CVSS metrics in sources). The co...

CVE-2021-0530

CVE-2021-0530 is an Android memory management driver vulnerability described across multiple sources as an out-of-bounds write caused by uninitialized data, enabling local privilege escalation with no user interaction required. Connected data identify affected component as the Android memory mana...

CVE-2021-0630

CVE-2021-0630 affects MediaTek WiFi driver components. The flaw is a missing bounds check in the wifi driver that can cause a system crash, enabling remote denial of service with no additional privileges or user interaction required. Several connected sources (NVD, Red Hat advisories, CVE registr...

CVE-2021-0662

The CVE-2021-0662 entry concerns MediaTek audio DSP with a local privilege-escalation flaw caused by an out-of-bounds write from an incorrect bounds check. Connected documents specify the affected MediaTek audio DSP hardware and firmware, including chip family (MT6779, MT6781, MT6785, MT68xx, MT6...

CVE-2021-0665

CVE-2021-0665 concerns the apusys subsystem. Affected component: apusys (likely MediaTek-based). Root cause: an out-of-bounds read caused by an incorrect bounds check. Impact: local information disclosure with system execution privileges required; no user interaction needed. Exploitation status i...

CVE-2021-0679

CVE-2021-0679 affects MediaTek’s apusys. The issue is a memory corruption caused by a missing bounds check in apusys that could lead to local privilege escalation with System execution privileges required; exploitation is possible without user interaction. A patch is referenced (ALPS05672107; ALP...

CVE-2021-0893

CVE-2021-0893 affects the MediaTek Apusys component. The vulnerability is a memory corruption via a use-after-free, potentially enabling local escalation of privileges with System execution privileges required; no user interaction is necessary. Patches exist (Patch ID: ALPS05672107; Issue ID: ALP...

CVE-2021-0894

In CVE-2021-0894, the apusys component contains an out-of-bounds write due to a missing bounds check. This can enable local escalation of privilege to SYSTEM with no user interaction required. Patch ID ALPS05672107 and Issue ID ALPS05672038 are associated remediation details. Exploitation status ...

CVE-2021-1038

CVE-2021-1038 describes a DoS via a tapjacking/overlay vulnerability in UserDetailsActivity of AndroidManifest.xml, affecting Android 9–12. The root cause is an overlay/tapjacking issue that can cause local denial of service with no extra privileges; exploitation requires user interaction per CVS...

CVE-2021-1039

CVE-2021-1039 affects Android Platform apps: NotificationAccessActivity in AndroidManifest.xml can enable a local elevation of privilege via a tapjacking/overlay trick. Affected: Android 9–12. Root cause: overlay/tapjacking allows bypass of user interaction requirements to gain higher privileges ...

CVE-2021-25417

CVE-2021-25417 affects the SDP SDK prior to Samsung SMR JUN-2021 Release 1, where improper authorization allows access to internal storage. The vulnerability is documented across multiple sources (NVD entry; Red Hat advisory; PRION; CVE listing; CNNVD) with CVSS v3.1 base score 7.5 (Network, Low ...

CVE-2021-25426

CVE-2021-25426 concerns Samsung Message’s SmsViewerActivity, where improper component protection permits untrusted apps to access Message files. Affected: Samsung Message versions before SMR July-2021 Release 1. Root cause is lack of proper access controls on SmsViewerActivity. Impact, as stated,...

CVE-2021-25429

Technical details (affected product/versions/root cause/exploit status) are not publicly available in the provided documents. Monitor for updates from NVD/Red Hat and security advisories.

CVE-2021-25450

CVE-2021-25450 describes a path traversal vulnerability in FactoryAirCommnadManger present before Samsung SMR Sep-2021 Release 1. An attacker could write files as the system UID via a remote socket by exploiting the vulnerable path handling in the component, leading to potential unauthorized file...

CVE-2021-25502

CVE-2021-25502 relates to Samsung SMR (System Management Release) before the Nov-2021 Release 1, where sensitive data was stored insecurely in Property Settings, allowing a local attacker to read the ESN value without privileges. Affected product scope is Samsung SMR updates for Android/mobile de...

CVE-2021-25511

The CVE-2021-25511 issue affects Samsung FilterProvider prior to SMR Dec-2021 Release 1 and is described as an improper validation/path traversal vulnerability that enables an attacker to write arbitrary files. Documents consistently tie this to a path traversal flaw and do not provide exploit co...

CVE-2022-20019

CVE-2022-20019 affects the MediaTek libMtkOmxGsmDec component. The issue is an incorrect bounds check that may allow local information disclosure without requiring additional execution privileges; user interaction is not needed. The CVE description and Red Hat/NVD entries confirm the impact is li...

CVE-2022-20320

CVE-2022-20320 affects Android 13 and involves the ActivityManager. The issue enables a local attacker to infer whether an app is installed without query permissions, via a side-channel information disclosure. The exploitation is described as requiring local access (no user interaction) and not n...

CVE-2022-20429

CVE-2022-20429 affects Android’s CarSettings component across Android-10/11/12/12L. The issue enables a local elevation of privilege in Bluetooth settings via a confused deputy, requiring no user interaction and permitting an adjacent attacker with no privileges to exploit (per the referenced NVD...

CVE-2022-32611

CVE-2022-32611 concerns MediaTek’s isp component. The vulnerability is an out-of-bounds write caused by a missing bounds check, enabling local escalation of privileges with System execution privileges required. Exploitation reportedly does not require user interaction. A patch is referenced (Patc...

CVE-2022-32615

CVE-2022-32615 concerns an out‑of‑bounds write in the ccd component caused by uninitialized data, enabling local privilege escalation with system execution privileges required. No user interaction is needed. The vulnerability details are supported by multiple sources in the provided documents, wi...

CVE-2022-39080

CVE-2022-39080 concerns a missing permission check in the messaging service that could allow elevation of privilege in the contacts service without extra execution privileges. Connected documents reference the issue in UNISOC chipset contexts (SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T618/T612...

CVE-2022-39084

CVE-2022-39084 relates to UNISOC chipset network service with a missing permission check, enabling local privilege escalation requiring system execution privileges. CVSS details show Local access, high impact on confidentiality, integrity, and availability (score 6.7). Concrete affected-entity: U...

CVE-2022-39855

CVE-2022-39855 is a local-improper access-control vulnerability in the FACM application prior to Samsung SMR Oct-2022 Release 1. The issue allows a local attacker to connect to arbitrary AP and Bluetooth devices due to insufficient access controls in FACM. Affected context: Samsung mobile devices...

CVE-2022-47334

CVE-2022-47334 concerns the phasecheck server, where a missing bounds check can cause an out-of-bounds read. This vulnerability is described as enabling a local denial of service with system execution privileges required. The connected documents consistently relay the same underlying issue, thoug...

CVE-2022-47457

CVE-2022-47457 concerns the wlan driver (UNISOC chipsets) with a missing parameters check in the WLAN module, enabling local denial of service in wlan services. The root cause is insufficient input validation in the driver; affected software is described as the wlan driver, with no specific versi...

CVE-2022-47472

The CVE-2022-47472 issue affects the telephony service (notably in UNISOC chipsets) due to a missing permission check, enabling local information disclosure without extra execution privileges. The NVD/CVEs list a CVSS v3.1 base score of 5.5 (Medium) with LOCAL attack vector, LOW privileges requir...

CVE-2022-48382

CVE-2022-48382 concerns UNISOC chipsets’ log service. The root cause is a missing bounds check that enables an out-of-bounds write. Impact described as local denial of service with system privileges required. Exploitation details are not provided in the connected documents. Remediation/patch info...

CVE-2023-20624

CVE-2023-20624 describes a potential out-of-bounds write in the vow module due to an incorrect bounds check, which could enable local escalation of privilege with System execution privileges needed. User interaction is not required for exploitation. The issue affects MediaTek vow-related componen...

CVE-2023-20626

CVE-2023-20626 affects MediaTek’s msdc module. The issue is an out-of-bounds write caused by an incorrect bounds check, enabling local escalation of privileges with System execution privileges required and no user interaction needed. Several connected records corroborate the vulnerability in msdc...

CVE-2023-20627

CVE-2023-20627 affects pqframework. The root cause is a missing bounds check leading to an out-of-bounds write that could allow local escalation to system privileges with no user interaction required. Impact is high for confidentiality, integrity, and availability per the cited CVSS details, with...

CVE-2023-20638

CVE-2023-20638 affects the ril component of MediaTek chips, caused by a missing bounds check that enables an out-of-bounds write. This could lead to local escalation of privilege with System execution privileges required. User interaction is not needed for exploitation. A patch is available: ALPS...

CVE-2023-20666

CVE-2023-20666 concerns a MediaTek display DRM component with an out-of-bounds write caused by a missing bounds check. The vulnerability enables local privilege escalation to System level without user interaction. The issue is indicated to affect the Display DRM path, with a patch identifier ALPS...

CVE-2023-20680

The connected documents confirm CVE-2023-20680 affects the adsp component and describes an out-of-bounds write caused by improper input validation. This can enable local escalation of privilege with system execution privileges, and exploitation does not require user interaction. The public fix re...

CVE-2023-20795

The CVE-2023-20795 entry describes a vulnerability in the ril module (MediaTek-based environments) where a missing bounds check enables an out-of-bounds write. This can lead to local privilege escalation with System execution privileges required, and exploitation does not require user interaction...

CVE-2023-21371

CVE-2023-21371 affects Android’s Secure Element. The issue is an out-of-bounds write caused by an integer overflow in Secure Element code, enabling local escalation of privilege to System execution privileges without user interaction. Exploitation details are not provided in the connected documen...