CVE-2018-9451

CVE-2018-9451 affects Android, where DynamicRefTable::load in ResourceTypes.cpp has a missing bounds check causing an out-of-bounds read. This leads to local information disclosure without requiring user interaction. Vulnerable Android versions include 6.0–8.1; patch availability is tied to Andro...

CVE-2018-9454

CVE-2018-9454 affects Android (Android 6.0–8.1). Root cause: in bnep_data_ind of bnep_main.cc, a missing bounds check allows an out-of-bounds read, leading to possible local information disclosure without extra privileges. Impact is information disclosure; exploitation requires local access and d...

CVE-2018-9474

CVE-2018-9474 is a local elevation-of-privilege in Android’s Media Framework, triggered by a serialization/deserialization mismatch in MediaPlayer.writeToParcel. Affected software includes Android 7.0–9; exploited via crafted media content with no user interaction. The issue is documented in the ...

CVE-2018-9528

CVE-2018-9528 affects ixheaacd_over_lap_add1_armv8: in ixheaacd_overlap_add1.s, a missing bounds check allows an out-of-bounds write. This could enable remote code execution on Android 9 (Android-9) with user interaction required for exploitation. The vulnerability is tied to the ixheaacd compone...

CVE-2018-9537

CVE-2018-9537 affects Google Android 9 (Android-9) and is caused by a missing bounds check in CAacDecoder_DecodeFrame within aacdecode.cpp, leading to a possible out-of-bounds write. The consequence is remote code execution in the media server with no additional execution privileges, requiring us...

CVE-2018-9559

CVE-2018-9559: In persist_set_key and related cryptfs.cpp functions, there is an out-of-bounds write caused by an uncaught error, enabling local elevation of privilege without user interaction on Android 7.0–9. No exploitation details are provided. The Android Security Bulletin indicates patches ...

CVE-2018-9570

CVE-2018-9570 affects Android 9 and involves an out-of-bounds write in impd_parse_drc_ext_v1 within impd_drc_dynamic_payload.c. The root cause is missing bounds checking in this function, which could allow remote code execution with a local attacker?no, this CVE entry states remote code execution...

CVE-2018-9587

CVE-2018-9587 affects Android 7.0–9 (Android-7.0, -7.1.1, -7.1.2, -8.0, -8.1, -9). In ContactPhotoUtils.java (savePhotoFromUriToUri), a confused deputy scenario could allow unauthorized access to files in the Contacts app, enabling local elevation of privilege. The vulnerability is local (attack ...

CVE-2019-2052

CVE-2019-2052 : In VisitPointers of heap.cc, Android’s System component, there is a potential out-of-bounds read caused by type confusion. This could enable remote information disclosure without extra execution privileges or user interaction. Affected Android versions include 7.0, 7.1.1, 7.1.2, 8...

CVE-2019-20533

CVE-2019-20533 affects Samsung mobile devices running N(7.x), O(8.x), and P(9.0) (China/India releases). The issue: the S Secure app can launch masked apps without a password. Root cause and technical specifics beyond this summary are not provided in the connected documents. The entry references ...

CVE-2019-20570

CVE-2019-20570 affects Samsung mobile devices running Android versions P (9.0), O (8.0), and N (7.1), where attackers can bypass Factory Reset Protection (FRP) using Smart Switch. The Red Hat, ENISA, CNVD, and other connected feeds corroborate the same FRP-bypass issue, identifying the Samsung ID...

CVE-2019-20571

The CVE-2019-20571 entry describes a type confusion vulnerability in the WVDRM Trustlet on Samsung mobile devices running O(8.x) with TEEGRIS, allowing arbitrary code execution. Affected component: WVDRM Trustlet; root cause: type confusion. Impact: arbitrary code execution with high severity (pe...

CVE-2019-20579

Samsung reports a vulnerability in the Gallery app on Galaxy devices running N(7.x), O(8.x), and P(9.0) that allows attackers to enable location information sharing from the lock screen. The entry references Samsung ID SVE-2019-14462 (August 2019). No concrete exploit details, affected specific m...

CVE-2019-20597

CVE-2019-20597 affects Samsung mobile devices running N(7.1), O(8.x), and P(9.0). The vulnerability exists in the SPENgesture component, which can allow arbitrary applications to read or modify user-input logs. This impacts confidentiality and integrity (CVSSv3.1: 9.1, CRITICAL; CVSSv2: 6.4, MEDI...

CVE-2019-20599

Technical details for CVE-2019-20599 are not publicly available in the provided documents. The connected sources repeat the same description without concrete exploit, impact, vulnerable components, or fixes. Monitor for updates from official advisories.

CVE-2019-20616

Technical details (affected component, root cause, version-specific impact, or fixes) are not publicly provided in the connected documents. Monitor for updates from Samsung and security advisories.

CVE-2019-20617

The CVE-2019-20617 entry describes a vulnerability in Samsung mobile devices running P (9.0) software where the Secure Folder leaks preview data of recently used apps. Affected software is Samsung mobile devices with P(9.0); exact component/file, root cause, and vulnerable version details are not...

CVE-2019-2122

CVE-2019-2122 affects Android 7.0–9, describing a local privilege-escalation in LockTaskController.lockKeyguardIfNeeded due to a differing default-case handling between WindowManager and Settings. Impact: potential elevation of privileges with user interaction required; exploitability is local. C...

CVE-2019-2140

CVE-2019-2140 affects libxaac in Android 10, stemming from uninitialized data that can cause information disclosure. Impact: partial confidentiality loss with no full compromise; exploitation requires user interaction. Affected component is libxaac in Android 10, with Android’s release notes indi...

CVE-2019-2164

CVE-2019-2164 affects Android 10 due to an out-of-bounds read in libxaac caused by a missing bounds check. This could disclose information without full execution privileges; exploitation requires user interaction. The Red Hat entry confirms the same description; no patch/version details are provi...

CVE-2019-2191

CVE-2019-2191 affects LG’s LAF component, exposing information from a protected disk partition due to a missing bounds check. This permits local information disclosure via USB with no user interaction; exploitation requires user privileges and is possible without user action. The related Red Hat/...

CVE-2019-2192

CVE-2019-2192 corresponds to a local elevation of privilege in the Android Framework (SliceProvider.java). Affected: Android 9 and 10. Description states a permissions bypass due to improper input validation, enabling a local attacker to gain additional permissions without user interaction. Impac...

CVE-2019-2209

CVE-2019-2209 affects Android components (BTA_DmPinReply in bta_dm_api.cc). The issue is an out-of-bounds read caused by an incorrect bounds check, leading to local information disclosure with user privileges, no user interaction required. Affected Android versions: 8.0–10.0. Connected Red Hat/NT...

CVE-2019-2210

CVE-2019-2210 affects Android 9–10 where the qmi_vs_service.cc load_logging_config path can trigger an out-of-bounds write caused by a heap buffer overflow, enabling local privilege escalation without user interaction. Public sources (NVD/Red Hat/NVD list, Pixel bulletin) identify this as a Local...

CVE-2019-9268

CVE-2019-9268 affects Android’s media stack (libstagefright) with a use-after-free caused by improper locking, enabling local escalation of privilege in the media server without extra privileges. The issue is tied to Android 10 (Android-10) and is documented in the Android 10 Security Release Not...

CVE-2019-9285

CVE-2019-9285 describes an out-of-bounds read in Bluetooth on Android 10 due to a missing bounds check. Exploitation could lead to remote DoS without user interaction. Affected product/variant: Android 10 (Android ID: A-111215315). Public metrics: CVSSv3.1 base score 7.5 (High) with network attac...

CVE-2019-9305

CVE-2019-9305 affects libAACdec in Android 10 (Android-10). The root cause is an integer overflow causing an out-of-bounds write, enabling remote code execution. Exploitation requires user interaction; no additional privileges are needed beyond the targeted device. Documented under Android 10 rel...

CVE-2019-9353

CVE-2019-9353 affects Android 10 Bluetooth stack; root cause is a missing bounds check causing an out-of-bounds read, enabling potential information disclosure. NVD notes user interaction not required for exploitation in some vectors and network-based access; ZDI-19-640 details a Bluetooth heap-b...

CVE-2019-9381

CVE-2019-9381 affects Android’s netd, with an out-of-bounds read caused by a use-after-free. This leads to remote information disclosure without additional privileges or user interaction on Android 10. The available documents confirm the vulnerable component and the impact but do not provide expl...

CVE-2019-9384

CVE-2019-9384 affects Android 10 in the framework component LockPatternUtils. The issue is an improper permissions check that enables elevation of privilege by bypassing the Lockguard, granting System-level execution privileges without user interaction. The CVE entry notes local exploitation is p...

CVE-2019-9391

CVE-2019-9391 is a vulnerability in the Android 10 libxaac library where an out-of-bounds read can occur due to uninitialized data, leading to information disclosure. The issue affects Android-10 (Android 10) and requires user interaction to exploit. The available sources in the provided document...

CVE-2019-9415

CVE-2019-9415 affects Android 10 via the libstagefright component. The issue is an information-disclosure vulnerability caused by uninitialized data, enabling remote information leakage without extra execution privileges. Exploitation requires user interaction. Public details originate from Andro...

CVE-2020-0038

CVE-2020-0038 affects Android devices (Android 8.0–10) due to a missing bounds check in rw_i93_sm_update_ndef of rw_i93.cc , which can cause a read of uninitialized data and lead to remote information disclosure without additional execution privileges or user interaction. The available documents ...

CVE-2020-0086

CVE-2020-0086 affects Android 10. In Parcel.cpp, readCString may perform an out-of-bounds write due to an integer overflow, potentially enabling arbitrary code execution if IntSan is not enabled (it is by default). The vulnerability requires no user interaction and can be exploited remotely over ...

CVE-2020-0132

CVE-2020-0132 affects Android 10 via BnAAudioService::onTransact in IAAudioService.cpp, where unsafe deserialization can trigger an out-of-bounds read. The underlying bug permits local information disclosure without extra privileges or user interaction. Publicly documented references in the Pixel...

CVE-2020-0140

CVE-2020-0140 relates to Android 10 and is described in multiple sources as an information-disclosure vulnerability due to a missing bounds check in rw_i93_sm_detect_ndef of rw_i93.c. The underlying issue can enable remote information disclosure without extra execution privileges and without user...

CVE-2020-0146

CVE-2020-0146 affects Android 10 in the btu_hcif hardware path (btu_hcif.cc). The issue is a missing bounds check that enables an out-of-bounds read, potentially allowing local information disclosure with system privileges. No user interaction is required. The Red Hat and NVD entries corroborate ...

CVE-2020-0151

CVE-2020-0151 affects Android 10 and is triggered in the avb_vbmeta_image_verify function of avb_vbmeta_image.c. The flaw is an out-of-bounds read due to a missing bounds check, leading to possible local information disclosure with system privileges (no user interaction required). Public details ...

CVE-2020-0155

CVE-2020-0155 affects Android 10, specifically in the NFC HAL code path: phNxpNciHal_send_ese_hal_cmd in phNxpNciHal_ext.cc. The root cause is a missing bounds check that enables an out-of-bounds write. Impact per the description is local elevation of privilege with user privileges required; expl...

CVE-2020-0193

CVE-2020-0193 is a vulnerability in Android 10 affecting the video codec path ihevc_intra_pred_chroma_mode_3_to_9_av8, described as an out-of-bounds read due to a heap buffer overflow. The issue could lead to remote information disclosure without additional execution privileges; exploitation requ...

CVE-2020-0205

Technical details for CVE-2020-0205 are not publicly available in the provided documents. Monitor for updates.

CVE-2020-0209

CVE-2020-0209 affects Android 10 Framework (AccountManager.java). Description: permissions bypass in multiple AccountManager functions could enable local elevation of privilege without additional execution privileges required; exploitation requires no user interaction. Evidence across documents s...

CVE-2020-0232

CVE-2020-0232 is reported in the Android kernel (Airbrush component). The issue arises when abc_pcie_issue_dma_xfer_sync creates a transfer object, stores it in a session, and a concurrent thread can fetch that object and delete it via abc_pcie_dma_user_xfer_clean. If this occurs, the original th...

CVE-2020-0264

CVE-2020-0264 affects Android 11, specifically libstagefright. It describes a possible out-of-bounds write caused by an integer overflow in the media framework, which could enable remote code execution. Exploitation requires user interaction. The issue is documented across multiple sources and is...

CVE-2020-0273

CVE-2020-0273 describes an out-of-bounds write in hwservicemanager that may allow local privilege escalation without user interaction on Android 11. The root cause is freeing a wild pointer. Documented impact is local elevation of privilege with partial confidentiality/integrity/availability impa...

CVE-2020-0288

CVE-2020-0288 concerns Android 11’s PackageManager, where a missing permission check could enable local information disclosure across user boundaries without any user interaction. The issue is tied to the Android 11 platform and is documented in the Android 11 Security Release Notes; Red Hat and ...

CVE-2020-0308

CVE-2020-0308 affects the Android 11 Window Manager. The root cause is an unsafe PendingIntent that enables a permission bypass, allowing local information disclosure without user interaction. Vulnerable component: Window Manager (Android-11). Impact: information disclosure with user privileges; ...

CVE-2020-0361

CVE-2020-0361 affects Android 11 via the libDRCdec information-disclosure flaw. The root cause is uninitialized data in libDRCdec, enabling remote information disclosure with no execution privileges required; exploitation requires user interaction per the CVSS vector. Connected sources corroborat...

CVE-2020-0486

CVE-2020-0486 affects Android 11 (ContactsProvider2.java) via openAssetFileListener, where an insecure default value enables a permission bypass. This can allow local escalation of privilege to modify contact data with no additional execution privileges and no user interaction. The issue is ackno...

CVE-2020-12750

CVE-2020-12750 describes a vulnerability in Samsung mobile devices running Q (Android 10) where Factory Reset Protection (FRP) can be bypassed via SPEN. The issue affects Samsung devices with Q(10.0) software; multiple feeds (NVD, Red Hat, CNVD, CVE listings) corroborate the same impact. The core...