CVE-2021-0495

CVE-2021-0495 : In Android, a memory management driver has an out-of-bounds write due to uninitialized data, enabling local elevation of privilege. Exploitation is Local with no user interaction required; no explicit exploit details or patch versions are provided in the connected documents.

CVE-2021-25414

CVE-2021-25414 affects Samsung Contacts prior to SMR JUN-2021 Release 1. The underlying issue is improper sanitization of an incoming intent in Samsung Contacts, which enables a local attacker to copy or overwrite arbitrary files using Samsung Contacts privileges. The vulnerability implies local,...

CVE-2020-10833

CVE-2020-10833 affects Samsung mobile devices running Q(10.0). The issue is in the DeX Lockscreen, which can allow attackers to access the quick panel and notifications. The Samsung internal ID is SVE-2019-16532 (March 2020). No explicit exploitation details, affected versions, or fixes are provi...

CVE-2020-10845

CVE-2020-10845 describes a race condition that leads to a use-after-free in the MTP stack on Samsung mobile devices running O(8.x), P(9.0), and Q(10.0) software. The Samsung internal identifier is SVE-2019-16520 (February 2020). The available documents do not provide concrete details on vulnerabl...

CVE-2020-10854

CVE-2020-10854 concerns information disclosure on Samsung mobile devices running O(8.x), P(9.0), or Q(10.0) software, where kernel stack addresses are leaked to userspace. The issue affects the kernel exposure path and is classified with a high impact in CVSS 3.1 (base score 7.5) and medium in CV...

CVE-2020-15581

CVE-2020-15581 affects Samsung mobile devices running O(8.x), P(9.0), and Q(10.0). The issue is in the kernel logging feature, which can allow attackers to discover virtual addresses via vectors involving shared memory. The reported impact is partial disclosure of data (confidentiality impact) wi...

CVE-2020-15582

Summary of CVE-2020-15582 : A BLE buffer overflow issue was reported on Samsung mobile devices running P (9.0) and Q (10.0) on Exynos 7885, leading to a deadlock or crash in the Bluetooth Low Energy component. The Samsung internal ID is SVE-2020-16870 (July 2020). Connected documents confirm the ...

CVE-2020-15583

This CVE pertains to Samsung mobile devices running O(8.x), P(9.0), and Q(10.0) where the StickerProvider allows directory traversal to access system files. Root cause: improper validation in the StickerProvider component enables path traversal that could lead to exposure of sensitive files. The ...

CVE-2020-25282

Technical details about CVE-2020-25282 are not publicly available in the provided connected documents. No specifics on affected products, components, root cause, impact, or fixes are present. Monitor for updates from the cited sources.

CVE-2020-25283

CVE-2020-25283 affects LG mobile devices running Android 8.x–10. The issue is described as the BT Manager bypassing intended access restrictions on a certain mode. The connected records indicate the affected product family (LG Android devices) and component involved (BT Manager), but do not provi...

CVE-2020-27024

CVE-2020-27024 affects Android 11. In smp_br_state_machine_event of smp_br_main.cc, there is a missing bounds check causing an out-of-bounds read that can lead to remote information disclosure triggered by a malformed Bluetooth packet, with no user interaction. Bounds Sanitizer mitigates this in ...

CVE-2020-27035

CVE-2020-27035 : In Android’s media stack, specifically in priorLinearAllocation() of C2AllocatorIon.cpp, there is a possible use-after-free caused by improper locking. This can lead to local information disclosure in the media codec without additional execution privileges. Affected: Android-11. ...

CVE-2020-27045

CVE-2020-27045 is reported in Android as a heap overflow in CE_SendRawFrame within ce_main.cc, causing an out-of-bounds write. The issue is described as a local elevation of privilege vulnerability requiring user interaction for exploitation. Affected product line is Android 11. In the available ...

CVE-2021-0348

The CVE-2021-0348 issue affects Android’s vpu as reported in multiple sources. A missing bounds check enables an out-of-bounds write, leading to local escalation of privilege with System execution privileges required. Impact is noted for Android-9, Android-10, and Android-11. No user interaction ...

CVE-2021-0418

CVE-2021-0418 concerns the Mediatek memory management driver, where improper input validation can cause a local system crash leading to denial of service without user interaction. The issue is described across multiple sources (NVD, Red Hat) with the same core weakness. The patch reference provid...

CVE-2021-0461

CVE-2021-0461 (Android kernel, iaxxx-core sensor) : The issue arises in iaxxx_core_sensor_change_state within iaxxx-module.c, where a missing bounds check can cause an out-of-bounds write. This leads to local escalation of privilege with System execution privileges required, and exploitation does...

CVE-2021-0528

CVE-2021-0528 describes a vulnerability in the Android memory management driver (MediaTek MTK chipset) where a double free leads to memory corruption, enabling local privilege escalation with no extra user interaction. The issue is categorized as a local privilege escalation (local access, no use...

CVE-2021-0612

CVE-2021-0612 describes a memory corruption in the m4u component, caused by a use-after-free, enabling local escalation of privilege with system execution privileges required. Exploitation reportedly does not require user interaction. Affected context is Mediatek-based hardware; patch ALPS0540349...

CVE-2021-0619

CVE-2021-0619 affects the ape extractor and describes an out-of-bounds read caused by a missing bounds check, leading to local information disclosure with no additional execution privileges required. Exploitation appears to be local, with user interaction not needed, and a patch/mitigation is ref...

CVE-2021-0624

CVE-2021-0624 affects the flv extractor component; the root cause is an out-of-bounds read caused by a heap buffer overflow, leading to local information disclosure without extra execution privileges and with no user interaction required. The vulnerability is referenced with Patch ID ALPS05594988...

CVE-2021-0670

The CVE-2021-0670 entry concerns an issue in the apusys component where a use-after-free can cause memory corruption, enabling local escalation of privilege with SYSTEM execution privileges; exploitation reportedly does not require user interaction. Patch ID ALPS05654663 (Issue ID ALPS05654663) i...

CVE-2021-25388

Samsung Knox Core CVE-2021-25388 is described as an improper caller check vulnerability that, in Knox Core prior to SMR MAY-2021 Release 1, could let a local attacker install arbitrary third‑party apps. Connected sources (NVD, Red Hat, CNNCVD/CVE lists) corroborate: local access, low complexity, ...

CVE-2021-25408

CVE-2021-25408 concerns a buffer overflow in the NPU driver prior to Samsung SMR JUN-2021 Release 1. The underlying issue is a memory overwrite vulnerability in the driver that could lead to arbitrary memory write and code execution. Affected product scope is the NPU driver as described; no speci...

CVE-2021-25455

Summary: CVE-2021-25455 is an OOB read vulnerability in the libsaviextractor.so library, reported to affect the pre-SMR Sep-2021 Release 1. The available descriptions state that an attacker could access an arbitrary memory address via a forged AVI file, via a crafted input, with a local attack ve...

CVE-2021-25468

CVE-2021-25468 concerns a memory-access vulnerability in Samsung Widevine Trustlet. Multiple sources indicate that Widevine trustlet versions prior to SMR Oct-2021 Release 1 are affected and that an attacker with local access could read arbitrary memory addresses due to a boundary/memory check is...

CVE-2021-25469

The vulnerability CVE-2021-25469 affects Widevine trustlet prior to Samsung SMR Oct-2021 Release 1. It is a stack-based buffer overflow in the trustlet that can lead to arbitrary code execution with local access and low attack complexity. Impact is partial to high confidentiality/integrity/availa...

CVE-2021-25512

CVE-2021-25512 affects the Samsung telephony stack. Connected documents indicate an improper validation vulnerability in telephony prior to Samsung SMR Dec-2021 Release 1, allowing attackers to launch certain activities. Affected: telephony component on Samsung devices (prior to SMR Dec-2021 Rele...

CVE-2022-42766

The CVE-2022-42766 entry concerns the wlan driver where a missing permission check could allow local information disclosure. Connected sources consistently describe this as a local-privilege issue affecting the wlan driver, with impact on confidentiality (high) and limited attack complexity (low)...

CVE-2022-47479

CVE-2022-47479 affects the telephony service. The root cause is a missing permission check, enabling local information disclosure without requiring additional privileges. CVSSv3.1 metrics indicate Local attack vector, Low attack complexity, Low privileges required, and Confidentiality impact High...

CVE-2022-48232

CVE-2022-48232 concerns UNISOC chipsets’ FM service with a missing parameter check, enabling local denial of service. Connected sources corroborate a local impact; exploitation details are not provided, and there is no publicly available fix information in the supplied documents. Monitor for upda...

CVE-2023-20635

The CVE-2023-20635 issue concerns the keyinstall module (noted across multiple sources) where an integer overflow can lead to information disclosure. Reported impact is local information disclosure with system-level execution privileges required, and exploitation does not require user interaction...

CVE-2023-20642

The CVE-2023-20642 issue is a local out-of-bounds write in the ril module of MediaTek silicon. The root cause is a missing bounds check that can lead to local privilege escalation with System execution privileges required; no user interaction is needed for exploitation. Affected component is ril ...

CVE-2023-20701

In the provided CVE-2023-20701 context, the issue is a vulnerability in the widevine module of MediaTek chips. The root cause is a logic error that can trigger an out-of-bounds write, potentially enabling local escalation of privileges with system execution rights. Exploitation requires no user i...

CVE-2023-20808

CVE-2023-20808 affects OPTEE on MediaTek chipsets. The vulnerability is an out-of-bounds write caused by a missing bounds check in OPTEE, enabling local escalation of privileges with System execution privileges required and no user interaction needed. Exploitation status is not detailed in the pr...

CVE-2023-21332

CVE-2023-21332 concerns Android’s Text Services, where a side-channel could reveal whether an app is installed without query permissions. This enables local information disclosure with no extra execution privileges and no user interaction required. The issue is categorized as affecting the Text S...

CVE-2023-21340

The CVE-2023-21340 entry describes an information-disclosure vulnerability in the Telecomm component of Android, caused by a missing permission check that allows local access to the call state without extra privileges or user interaction. Exploitation is local and does not require user action; CV...

CVE-2023-40634

The CVE-2023-40634 entry describes a local privilege escalation in phasechecksercer/phasecheckserver due to a missing permission check. The impact is local with no additional execution privileges required, but the provided documents do not specify affected products, versions, exploit details, or ...

CVE-2023-42638

The CVE concerns the validationtools component and a missing permission check that could allow local information disclosure without additional execution privileges. The NVD entry assigns CVSS v3.1 base score 5.5 (Medium) with local attack vector and high confidentiality impact. Connected advisori...

CVE-2023-44127

CVE-2023-44127 involves LG-patched call management (com.android.server.telecom). The issue is that it launches implicit intents which disclose sensitive data (e.g., contact details and phone numbers) to all third-party apps on the same device. Exploitation details are not provided in the document...

CVE-2024-20109

CVE-2024-20109 affects the component identified as ccu (referenced across Red Hat/NVD entries and related advisories). The root cause is a missing bounds check that allows an out-of-bounds write, resulting in local escalation of privileges with System-level execution privileges required. No user ...

CVE-2025-0089

CVE-2025-0089 affects the Android Launcher application and is described as a logic error that can enable local escalation of privilege without user interaction. The issue is listed in the Android security bulletin with high severity (EoP) for Framework and related components, and patch levels 202...

CVE-2025-36902

In CVE-2025-36902, the vulnerable component is syna_tcm2_sysfs.c, specifically the syna_cdev_ioctl_store_pid() function. It reports a heap buffer overflow causing an out-of-bounds write, which could enable local escalation of privilege with System execution privileges required. Exploitation requi...

CVE-2025-48623

CVE-2025-48623 concerns the Linux kernel’s pkvm path in init_pkvm_hyp_vcpu, where an input validation error can cause an out-of-bounds write. The Red Hat/EUVD/NVD/NVD-enrichment entries corroborate a local privilege-escalation impact due to this improper validation, with no user interaction requi...

CVE-2026-0124

CVE-2026-0124 is described in connected sources as an out-of-bounds write due to a missing bounds check that enables local Elevation of Privilege without user interaction. In the Pixel security bulletin, it is listed under Pixel vulnerabilities as a Bootloader issue (EoP, Critical). The Red Hat a...

CVE-2014-9799

CVE-2014-9799 concerns Android on Nexus 5 and 7 (2013) devices before 2016-07-05, where a Qualcomm makefile omits -fno-strict-overflow, potentially enabling local privilege escalation via crafted apps that exploit incorrect compiler optimization of an integer-overflow protection mechanism. The is...

CVE-2014-9896

Technical details (affected product/component, root cause, impact, fix) are not publicly provided in the connected documents. Please monitor for updates from official advisories to obtain confirmed remediation guidance.

CVE-2014-9897

CVE-2014-9897 affects Android on Nexus 5, in Qualcomm components (sound/soc/msm/qdsp6v2/msm-lsm-client.c). The vulnerability arises because the code path in msm-lsm-client.c does not validate certain user-space data, enabling an attacker to obtain sensitive information via a crafted application. ...

CVE-2014-9965

Technical details about CVE-2014-9965 are not publicly available in the provided connected documents. The descriptions restate the parsing issue in Android CAF/Linux SCM call handling; monitor for updates from the cited sources.

CVE-2014-9980

Technical details for CVE-2014-9980 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2015-0576

CVE-2015-0576 describes a buffer overflow in the HSDPA component used by Qualcomm in Android CAF/Linux kernel implementations. Connected sources corroborate a Qualcomm HSDPA buffer overflow affecting CAF-based Android releases, with CNVD noting potential arbitrary-code execution or denial of serv...