8251 matches found
CVE-2021-25414
CVE-2021-25414 affects Samsung Contacts prior to SMR JUN-2021 Release 1. The underlying issue is improper sanitization of an incoming intent in Samsung Contacts, which enables a local attacker to copy or overwrite arbitrary files using Samsung Contacts privileges. The vulnerability implies local,...
CVE-2021-25453
CVE-2021-25453 affects Samsung devices due to improper access control in Bluetooth APIs prior to SMR Sep-2021 Release 1. The vulnerability allows untrusted applications to obtain Bluetooth information. Connected sources indicate the issue originates from Bluetooth API access controls, with mitiga...
CVE-2021-25456
CVE-2021-25456 affects the libswmfextractor.so component. The vulnerability is described as an out-of-bounds read that enables an attacker to cause a memcpy at an arbitrary address via a forged WMF file, implying memory corruption with possible in-memory impact. According to the sources, this is ...
CVE-2021-25470
CVE-2021-25470 affects TEEGRIS Secure OS prior to SMR Oct‑2021 Release 1. The issue is an improper caller check logic in the SMC call that can be used to compromise the Trusted Execution Environment (TEE). Impact is described as TEE compromise; no exploit details provided in the documents. Mitiga...
CVE-2021-25474
Summary (CVE-2021-25474): Samsung SystemUI prior to SMR Oct-2021 Release 1 contains an improper exception handling for the multi_sim_bar_show_on_qspanel value, enabling a user‑device denial of service once a shell privilege is gained. The issue is triggered in SystemUI and results in a permanent ...
CVE-2021-25486
CVE-2021-25486 concerns an information-disclosure vulnerability in the Samsung ipcdump module, present before SMR Oct-2021 Release 1. The issue allows an attacker to detect device information by analyzing log-packet data. Documents describe vulnerable component (ipcdump) and impact as information...
CVE-2022-20020
CVE-2022-20020 affects the libvcodecdrv component (noted in multiple sources, including Red Hat and CVE listings) where a missing bounds check can cause local information disclosure without requiring privileges or user interaction. Impact is confirmed as information disclosure; no exploitation ve...
CVE-2022-20320
CVE-2022-20320 affects Android 13 and involves the ActivityManager. The issue enables a local attacker to infer whether an app is installed without query permissions, via a side-channel information disclosure. The exploitation is described as requiring local access (no user interaction) and not n...
CVE-2022-30714
CVE-2022-30714 affects Samsung Mobile’s SemIWCMonitor prior to SMR Jun-2022 Release 1. The vulnerability is an information-disclosure flaw that allows local attackers to obtain MAC address information. No exploit details are provided in the available documents. The issue has been associated with ...
CVE-2022-30757
CVE-2022-30757 concerns the Samsung isemtelephony component. The available disclosures state an improper authorization flaw that lets an attacker obtain the device CID without the ACCESS_FINE_LOCATION permission, affecting versions before the Samsung SMR Jul-2022 Release 1. Public sources consist...
CVE-2022-36841
Affected software: libSDKRecognitionText.spensdk.samsung.so on Samsung devices. Vulnerability: heap-based overflow in PrepareRecogLibrary_Part function prior to SMR Sep-2022 Release 1, causing memory access fault. Exploitability/impact: CVE reports local access with memory impact; no explicit exp...
CVE-2022-36856
The CVE-2022-36856 entry concerns Samsung Telecom application on mobile devices. Affected component: Telecom application prior to SMR Sep-2022 Release 1. Root cause: improper access control that allowed an attacker to start emergency calls via undefined permission. Impact: demonstrated capability...
CVE-2022-39089
CVE-2022-39089 affects the mlog service, where a missing bounds check allows an out-of-bounds read. This can lead to local denial of service with SYSTEM privileges required. The public documents consistently describe the issue in the mlog service and the resulting impact, but do not provide concr...
CVE-2022-39119
CVE-2022-39119 describes a missing permission check in a network service that could allow local escalation of privilege without extra execution privileges. Multiple connected sources reference Unisoc chipsets/networks as the affected context, noting the issue stems from inadequate privilege valid...
CVE-2022-44422
CVE-2022-44422 affects the music service via a missing permission check, enabling local denial of service in the contacts service. The vulnerability is exploitable with local access and low privileges (UI:N, C:N, I:N, A:H; S:U). No public details on affected product versions or fixes are provided...
CVE-2022-47474
CVE-2022-47474 concerns a missing permission check in the telephony service, enabling local information disclosure without extra privileges. Documented impact is high confidentiality risk with local attack vector; no exploitation details or fixes are provided in the connected sources. Affected co...
CVE-2022-47485
CVE-2022-47485 involves a possibly out-of-bounds write in the modem control device due to a missing bounds check. Public details consistently reference local denial of service with system execution privileges required. Affected component is the modem control device in UNISOC chipsets; exact affec...
CVE-2022-47495
CVE-2022-47495 affects the soter service on UNISOC chipsets, caused by a missing bounds check leading to an out-of-bounds write. The documented impact is local denial of service with system execution privileges required. CVSS metrics indicate LOCAL attack vector, LOW complexity, HIGH privileges r...
CVE-2022-48381
CVE-2022-48381 affects the modem control device with an out-of-bounds write caused by a missing bounds check. The impact described in the sources is local denial of service with System execution privileges required, without mention of remote access. Documents consistently cite the same generic vu...
CVE-2022-48388
The CVE-2022-48388 entry concerns UNISOC Chipsets’ powerEx service module. The vulnerability arises from a missing permission check in the powerEx service, enabling local escalation of privilege with no additional execution privileges. Affected component: powerEx service on UNISOC chipsets. Impac...
CVE-2022-48444
The CVE-2022-48444 entry concerns the telephony service with a missing permission check that could allow a local attacker to cause denial of service without additional execution privileges. This is supported by NVD and Red Hat records, which describe a local, low-privilege, unprivileged-access vu...
CVE-2022-48451
CVE-2022-48451 affects Unisoc Bluetooth service. The issue is a race-condition leading to an out-of-bounds write, enabling local denial of service with System execution privileges. Documents consistently describe the vulnerability as a local issue in the Bluetooth service, without publicly disclo...
CVE-2023-20664
CVE-2023-20664: In gz, a double-free caused by a use-after-free leads to local escalation of privilege with System privileges required; no user interaction is needed for exploitation. Connected sources report patch ALPS07505952 (Issue ALPS07505952). Details across multiple feeds consistently desc...
CVE-2023-20706
CVE-2023-20706 affects the MediaTek apu module. The issue is an out-of-bounds read caused by a missing bounds check, enabling local information disclosure with no user interaction and no additional privileges required. Exploitation details or active exploit status are not provided in the document...
CVE-2023-20825
In duraspeed, a missing permission check enables local information disclosure without extra execution privileges or user interaction. Affected component/feature is unspecified in the provided details, and the vulnerability is linked to patch ALPS07951402 (Issue ALPS07951413). Exploitation is desc...
CVE-2023-21301
CVE-2023-21301 affects Android’s ActivityManagerService and enables a local attacker to determine whether an app is installed without query permissions through a side-channel information disclosure. This could lead to local privilege escalation without additional execution privileges or user inte...
CVE-2023-21318
CVE-2023-21318 affects the Android Framework layer in Android 14, where a side-channel information disclosure could allow an attacker to infer whether an arbitrary app is installed. The NVD entry describes a local attack with low complexity, requiring low privileges and no user interaction, leadi...
CVE-2023-21340
The CVE-2023-21340 entry describes an information-disclosure vulnerability in the Telecomm component of Android, caused by a missing permission check that allows local access to the call state without extra privileges or user interaction. Exploitation is local and does not require user action; CV...
CVE-2023-21373
CVE-2023-21373 affects Android Telephony: a missing permission check lets a guest user change the preferred SIM, enabling local elevation of privilege with no user interaction. Exploitation is local; impact is described as high (confidentiality, integrity, availability). No exploitation details i...
CVE-2023-32816
The CVE-2023-32816 entry describes a vulnerability in the gnss service where an out-of-bounds read results from improper input validation. The issue can lead to local information disclosure with system execution privileges required and does not require user interaction. A patch is identified: ALP...
CVE-2023-32849
In the provided documents, CVE-2023-32849 is tied to the cmdq module, where a type confusion causes an out-of-bounds write. This leads to local privilege escalation with System execution privileges required, and exploitation does not require user interaction. A patch/reference is listed as Patch ...
CVE-2023-32866
CVE-2023-32866 affects the MediaTek mmp module. The vulnerability is a memory corruption caused by an incorrect bounds check in mmp, enabling local escalation of privilege with System execution privileges required. Exploitation is reported to require no user interaction. The entry notes a patch/m...
CVE-2023-33888
CVE-2023-33888 affects the telephony service with a missing permission check that can lead to local information disclosure. Connected documents identify these as UNISOC-chipset telephony services, listing affected devices such as SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T618/T612/T616/T820/S80...
CVE-2023-33905
The CVE-2023-33905 issue affects the iwnpi server and is described as a missing bounds check causing an out-of-bounds write. Reported impact: local denial of service with System execution privileges required. The documents do not specify affected versions, exploitation details, or available fixes...
CVE-2023-42695
CVE-2023-42695 : In the wifi service, a missing permission check could allow local escalation of privilege. Multiple sources (NVD, Red Hat, CVE listing, CNNVD) describe this issue as a local, low-privilege path to obtain HIGH impact on confidentiality, integrity, and availability, with CVSSv3.1 b...
CVE-2023-44124
The CVE-2023-44124 issue affects the Screen recording app (com.lge.gametools.gamerecorder). The root cause is that the app launches implicit intents that can be intercepted by other apps on the device, and the returned data goes to onActivityResult, enabling theft of arbitrary files. The app stor...
CVE-2024-20119
The CVE-2024-20119 issue is in MediaTek’s mms component and stems from an incorrect bounds check causing an out-of-bounds write. This can lead to local escalation of privilege with SYSTEM execution privileges required; no user interaction is needed. Patch ID ALPS09062301; Issue ID MSV-1620 is ref...
CVE-2025-48549
This CVE (CVE-2025-48549) describes an elevation of privilege in Google Android where a background app can potentially record audio due to a missing permission check. The issue is local and requires no user interaction; exploitation is described as local with high impact. Android's security bulle...
CVE-2025-48553
CVE-2025-48553 impacts Android’s DevicePolicyManagerService.java, where a logic error in handlePackagesChanged can cause a denial-of-service on a device admin, enabling local privilege escalation without extra execution privileges or user interaction. The issue is documented across multiple sourc...
CVE-2025-48573
The CVE-2025-48573 entry describes a local elevation-of-privilege in Android's MediaSessionRecord.java via a path in sendCommand that could allow launching a foreground service while the app is backgrounded (FGS while-in-use abuse). The issue enables privilege escalation without extra execution p...
CVE-2025-48645
CVE-2025-48645 concerns Google Android. The vulnerability arises from an improper input validation in the Android framework’s DeviceAdminInfo.loadDescription, allowing a malicious local attacker to achieve local elevation of privilege without user interaction. The impact is described as persisten...
CVE-2026-0018
The CVE-2026-0018 issue affects AccessibilityManagerService.java and represents a local DoS caused by improper input validation across multiple functions. The impact is a persistent Denial of Service requiring no user interaction, with an attacker likely able to trigger it locally. The CVSS 3.1 v...
CVE-2026-0023
Technical details for CVE-2026-0023 are not publicly available in the provided documents. Monitor for updates.
CVE-2026-0080
Technical details are not publicly available in the provided documents; no affected products, versions, vectors, or mitigations are specified. Monitor for updates.
CVE-2026-28594
CVE-2026-28594 is a use-after-free vulnerability in the Android Framework component, caused by a logic error present in multiple locations. It enables local privilege escalation without requiring additional execution privileges or user interaction, rated CVSS 7.8 (High) . The affected AOSP versio...
CVE-2014-9792
CVE-2014-9792 overview (normal mode) Affected software: Android on Nexus 5 devices (qualcomm components) prior to the 2016-07-05 patch. What is vulnerable: arch/arm/mach-msm/ipc_router.c in Qualcomm components contains an incorrect integer data type. Root cause: the mismatch/incorrect integer typ...
CVE-2014-9871
CVE-2014-9871 involves multiple buffer overflows in drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c in Qualcomm components used by Android on Nexus 5 and Nexus 7 (2013). The underlying issue is a buffer overflow in a camera processing component, enabling a local attacker to escalate privi...
CVE-2014-9899
CVE-2014-9899 describes an information-disclosure flaw in the USB/ehci-msm2.c driver within Qualcomm components used by Android on Nexus 5 devices prior to 2016-08-05. The root cause is omission of certain minimum calculations before copying data, enabling a crafted application to obtain sensitiv...
CVE-2014-9908
CVE-2014-9908 corresponds to a Denial of Service vulnerability in Google Android affecting Android 4.4.4, 5.0.2, and 5.1.1. According to the description, a malicious actor could block Bluetooth access on the device (Android Bug ID A-28672558). The connected sources list the affected software vers...